CVE-2026-31381 Details
Description
An attacker can extract user email addresses (PII) exposed in base64 encoding via the state parameter in the OAuth callback URL.
A vulnerability allowing the extraction of user email addresses, encoded in base64, has been identified in the Gainsight Assist plugin. This information is exposed through the state parameter in the OAuth callback URL, following authentication attempts via Salesforce and Okta. The base64 encoding serves as mere obfuscation, not encryption, making it easy for third parties to access these email addresses through server logs, proxies, or browser history.
Gainsight has released a patched update for the Chrome and Outlook plugins to address this information disclosure vulnerability. Users should ensure they are using the latest version of the Gainsight Assist plugin.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Mar 20, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| NVD-CWE-noinfo | Insufficient Information to Classify Weakness | [email protected] |
| CWE-598 | Use of GET Request Method With Sensitive Query Strings | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| gainsight assist | All versions |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 16, 2026 | Initial Analysis | [email protected] |
| Mar 23, 2026 | CVE Modified | [email protected] |
| Mar 20, 2026 | New CVE Received | [email protected] |