HotelRunner B2B CVE-2025-4296
MEDIUMSeverity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N
Lifecycle Timeline
1DescriptionCVE.org
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in HotelRunner B2B allows Forceful Browsing.
This issue affects B2B: before 04.06.2025.
AnalysisAI
Open redirect in HotelRunner B2B enables unauthenticated remote attackers to silently forward victims from a trusted HotelRunner domain to an arbitrary external URL via a crafted link. The CVSS Scope:Changed rating reflects that the impact escapes the vulnerable component into the user's browser context, enabling phishing, credential harvesting, or malware delivery under the cover of a legitimate hospitality platform domain. No public exploit code exists and no active exploitation has been confirmed; EPSS of 0.17% (38th percentile) indicates low automated exploitation probability at this time.
Technical ContextAI
CWE-601 (URL Redirection to Untrusted Site) arises when an application accepts a user-controlled URL parameter and issues an HTTP redirect without validating that the destination is an allowed, trusted domain. HotelRunner B2B is a hospitality sector B2B platform; the vulnerability likely exists in a login flow, affiliate referral handler, or session redirect parameter that accepts an external URL. The CVSS vector AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N confirms the flaw is network-exploitable, requires no privileges, demands one click of user interaction, and yields Scope:Changed - meaning the integrity impact lands in a browser context outside the application's own security boundary. No CPE strings were provided in the intelligence data, so exact affected component paths cannot be confirmed beyond the version boundary of 04.06.2025.
Affected ProductsAI
HotelRunner B2B platform versions released before 04.06.2025 are affected. The vulnerability was disclosed by the Turkish National Cyber Incident Response Center (USOM/TR-CERT) via advisory TR-25-0169, available at https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-25-0169 and https://www.usom.gov.tr/bildirim/tr-25-0169. No CPE strings were provided in the source intelligence data, so affected versions cannot be enumerated beyond the 04.06.2025 cutoff date stated in the NVD entry.
RemediationAI
The vendor-indicated fix boundary is 04.06.2025 - operators should ensure their HotelRunner B2B deployment is running a build released on or after that date. Consult the USOM advisory at https://www.usom.gov.tr/bildirim/tr-25-0169 for confirmation of the patched release identifier, as an exact version string was not independently confirmed in the available intelligence data. As a compensating control pending upgrade, web application firewall rules can be configured to reject or sanitize requests containing unvalidated external URLs in redirect parameters (e.g., block patterns where a redirect parameter value resolves to a domain not in the application's allowlist). Note that WAF-level filtering of open redirects can produce false positives on legitimate affiliate or SSO redirect flows - test thoroughly before enforcing in block mode. Additionally, security awareness training for B2B users to recognize HotelRunner-branded phishing URLs reduces the social engineering surface until the patch is applied.
More in Open Redirect
View allA malicious third-party can give a crafted "ssh://..." URL to an unsuspecting victim, and an attempt to visit the URL ca
GFI Kerio Control versions 9.2.5 through 9.4.5 contain an HTTP response splitting vulnerability in the dest parameter of
PHP through 7.0.8 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect
Multiple open redirect vulnerabilities in Apache Struts 2.0.0 through 2.3.15 allow remote attackers to redirect users to
Open redirect vulnerability in age-verification.php in the Age Verification plugin 0.4 and earlier for WordPress allows
Open redirect vulnerability in Kaseya Virtual System Administrator (VSA) 7.x before 7.0.0.29, 8.x before 8.0.0.18, 9.0 b
Vulnerability in the Oracle Applications Framework component of Oracle E-Business Suite (subcomponent: Popup windows (li
Unspecified vulnerability in the Oracle Application Server Single Sign-On component in Oracle Fusion Middleware 10.1.4.3
Flarum is open source discussion platform software. Rated medium severity (CVSS 6.5), this vulnerability is remotely exp
Open redirect vulnerability in Novius OS 5.0.1 (Elche) allows remote attackers to redirect users to arbitrary web sites
Open redirect vulnerability in the Redirect function in stageshow_redirect.php in the StageShow plugin before 5.0.9 for
Nteract v.0.28.0 was discovered to contain a remote code execution (RCE) vulnerability via the Markdown link. Rated crit
Share
External POC / Exploit Code
Leaving vuln.today