Low · 1.1 CVE-2026-13140 EUVD-2026-38736

Stored Cross-Site Scripting in Canarytokens.org

Published Jun 24, 2026 · Updated Jun 24, 2026 · Assigned by ThinkstAppliedResearch

Description

Stored Cross-Site Scripting in the exposed AWS API key store of Thinkst Applied Research Canarytokens.

Anonymous exploitation requires knowledge of a random identifier.

This issue affects Canarytokens: from Docker tag sha-4116b92cb before sha-f5aa5c4e, from Git commit 4116b92cb before f5aa5c4e.

Vendor	Product	Affected	Fixed
Thinkst Applied Research	Canarytokens	sha-4116b92cb – < f5aa5c4e	f5aa5c4e