EUVD-2026-51261
GHSA-m58w-3wr6-xrfc
Severity by source
AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Remote, no auth, but needs SSO-timed phishing so AC:H/UI:R; token theft enables session takeover (C:H, I:L to act as user) with no availability impact.
Primary rating from Vendor (ibm).
CVSS VectorNVD
Lifecycle Timeline
2DescriptionNVD
IBM Planning Analytics Local 2.1.0 through 2.1.21 is vulnerable to an open redirect that allows an attacker to redirect users to arbitrary external websites via a crafted URL. If used in SSO authentication flows, this could result in exposure of session tokens and allow attackers to hijack user sessions.
AnalysisAI
Open redirect in IBM Planning Analytics Local versions 2.1.0 through 2.1.21 lets remote attackers craft URLs that bounce authenticated users to attacker-controlled external sites. When the product is deployed with SSO authentication, the redirect can leak session tokens carried in the flow, enabling session hijacking. No public exploit identified at time of analysis; this is not on CISA KEV and no POC is referenced in the provided data.
Technical ContextAI
IBM Planning Analytics Local is the on-premises deployment of IBM's enterprise planning, budgeting and analysis platform (the TM1 engine with the Planning Analytics Workspace web tier). The root cause is CWE-601 (URL Redirection to Untrusted Site / Open Redirect): a request parameter used to determine the post-action redirect destination is not validated against an allowlist of trusted hosts, so an attacker can supply an arbitrary external URL. The elevated risk here is contextual - in SSO authentication flows the redirect target can be reached while session-identifying material (tokens, authorization codes) is in transit, so an off-domain redirect becomes a token-exfiltration primitive rather than a mere navigation nuisance. The single affected CPE is cpe:2.3:a:ibm:planning_analytics_local, confirming the on-prem edition is in scope.
RemediationAI
Patch available per vendor advisory: apply the fix published by IBM at https://www.ibm.com/support/pages/node/7278566 (upgrade to the fixed release above 2.1.21 as directed there; the exact fixed version should be confirmed from that advisory as it was not provided in the input data). As compensating controls until patched, restrict or allowlist redirect destinations at a reverse proxy or WAF in front of Planning Analytics so only same-origin/trusted hosts are permitted as redirect targets, and harden the SSO integration to avoid passing session tokens through redirectable parameters. User-awareness measures against link-based phishing reduce the user-interaction requirement's exploitability. Trade-off: aggressive redirect filtering at a proxy can break legitimate post-login or deep-link flows, so validate that intended internal redirect paths remain functional after applying rules.
More in Open Redirect
View allA malicious third-party can give a crafted "ssh://..." URL to an unsuspecting victim, and an attempt to visit the URL ca
GFI Kerio Control versions 9.2.5 through 9.4.5 contain an HTTP response splitting vulnerability in the dest parameter of
PHP through 7.0.8 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect
Multiple open redirect vulnerabilities in Apache Struts 2.0.0 through 2.3.15 allow remote attackers to redirect users to
Open redirect vulnerability in age-verification.php in the Age Verification plugin 0.4 and earlier for WordPress allows
Open redirect vulnerability in Kaseya Virtual System Administrator (VSA) 7.x before 7.0.0.29, 8.x before 8.0.0.18, 9.0 b
Vulnerability in the Oracle Applications Framework component of Oracle E-Business Suite (subcomponent: Popup windows (li
Unspecified vulnerability in the Oracle Application Server Single Sign-On component in Oracle Fusion Middleware 10.1.4.3
Flarum is open source discussion platform software. Rated medium severity (CVSS 6.5), this vulnerability is remotely exp
Open redirect vulnerability in Novius OS 5.0.1 (Elche) allows remote attackers to redirect users to arbitrary web sites
Open redirect vulnerability in the Redirect function in stageshow_redirect.php in the StageShow plugin before 5.0.9 for
Nteract v.0.28.0 was discovered to contain a remote code execution (RCE) vulnerability via the Markdown link. Rated crit
Share
External POC / Exploit Code
Leaving vuln.today