CVE-2026-45173

MEDIUM

Idira Identity Browser Extension: Unauthorized Application Interaction via Origin Validation Failure

Title source: cna

Description

Idira Identity Browser Extension (Chrome, Firefox, and Edge builds) versions prior to 26.8.1 exhibit an origin validation flaw within its internal web-page verification routines. If an authenticated user navigates to a specially crafted webpage, this interaction could potentially allow a remote attacker to trigger unauthorized application interaction or execution parameters within the context of that authenticated browser session. CyberArk Security Bulletin: CA26-21

References (1)

Core 1

Core References

Vendor Advisory vendor-advisory

https://docs.cyberark.com/find-identity-administration-docs/latest/en/content/getstarted/identity-new-doc-location.htm

Scores

CVSS v3 6.5

EPSS 0.0016

EPSS Percentile 5.8%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact partial

Details

CWE

CWE-346

Status published

Products (2)

CyberArk Software, a Palo Alto Networks Company/Identity Browser Extensions 26.0.0 - 26.8.1

paloaltonetworks/idira_identity_browser_extension 26.0.0 - 26.8.1

Published Jun 11, 2026

Tracked Since Jun 12, 2026