{"data":{"id":"b23b92ad-6baa-46fd-846a-2714f0511cc7","title":"CVE-2026-33620: PinchTab is a standalone HTTP server that gives AI agents direct control over a Chrome browser. PinchTab `v0.7.8`…","summary":"PinchTab, a standalone HTTP server giving AI agents direct control over a Chrome browser, versions v0.7.8 through v0.8.3 accepted the API token from a `token` URL query parameter as well as the `Authorization` header. A valid credential sent in the URL can be exposed through URIs recorded by reverse proxy access logs, browser and shell history, clipboard history, and tracing systems. The issue is an unsafe credential transport pattern rather than an authentication bypass, and it affects only deployments with a configured token where a client uses the query-parameter form.","solution":"Fixed in v0.8.4, which removes query-string token authentication and requires safer header- or session-based authentication flows.","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-33620","publishedAt":"2026-03-26T21:17:06.410Z","cveId":"CVE-2026-33620","cweIds":["CWE-598"],"cvssScore":"4.3","cvssSeverity":"medium","severity":"medium","attackType":["other"],"issueType":"vulnerability","affectedPackages":["github.com/pinchtab/pinchtab@>= 0.7.8, < 0.8.4 (fixed: 0.8.4)"],"affectedPackageNames":["github.com/pinchtab/pinchtab"],"affectedPackageRefs":["go:github.com/pinchtab/pinchtab"],"affectedVendors":[],"affectedVendorsRaw":["PinchTab"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":"PinchTab accepts API token in URL query parameter","headlinePromptVersion":"h1","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N","attackVector":"network","attackComplexity":"low","privilegesRequired":"none","userInteraction":"required","exploitMaturity":"unknown","epssScore":0.00284,"epssCheckedAt":"2026-11-10T00:11:22.478Z","kevDateAdded":null,"advisoryAliases":["GHSA-mrqc-3276-74f8"],"affectedPackagesSource":"ghsa","affectedPackagesCheckedAt":"2026-10-10T03:50:14.690Z","patchAvailable":true,"disclosureDate":"2026-03-26T21:17:06.410Z","fixReleasedAt":"2026-03-19T01:58:04.000Z","daysToFix":-7,"fixCheckedAt":"2026-10-29T21:39:31.200Z","capecIds":null,"crossRefCount":0,"attackSophistication":"trivial","impactType":["confidentiality"],"aiComponentTargeted":"api","llmSpecific":false,"classifierConfidence":0.85,"researchCategory":null,"atlasIds":null,"fixes":[{"ecosystem":"go","name":"github.com/pinchtab/pinchtab","fixedVersion":"0.8.4","matchedVersion":"v0.8.4","fixReleasedAt":"2026-03-19T01:58:04.000Z","daysToFix":-7,"match":"ecosystem","source":"registry","status":"found","checkedAt":"2026-10-29T21:39:31.053Z"}]}}