Teampass versions older than 3.1.5.16 allow a blind Cross‑Site Scripting flaw in the login form’s "contraseña" parameter. When an authentication attempt fails, the entered username is displayed in the list of failed logins without proper encoding, causing arbitrary JavaScript to execute in the browser of an administrator who views that log. The flaw enables an attacker to run malicious code in the context of the admin session, potentially stealing session tokens, modifying data, or defacing the interface.

The vulnerability affects all Teampass deployments running any version prior to 3.1.5.16. The fix is included in version 3.1.5.24, which supersedes all vulnerable releases.

The flaw carries a high CVSS score of 9.3. No EPSS score is available, and the vulnerability is not listed in the KEV catalog. A remote attacker can submit a crafted request to the login endpoint without prior authentication and trigger the XSS when an administrator later opens the failed‑login log. Because the exploit requires only that the administrator view the log, the attack is relatively easy to perform on exposed administrative interfaces, making the risk significant.