EUVD-2026-34263
GHSA-9gjj-gmcx-6fhj
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Green
Primary rating from Vendor (CIRCL) · only source for this CVE.
CVSS VectorVendor: CIRCL
Lifecycle Timeline
4DescriptionCVE.org
An open redirect vulnerability existed in MISP UsersController::routeafterlogin() because the value stored in the pre_login_requested_url session key was used as the post-login redirect destination without sufficiently enforcing that it was a local application path.
An unauthenticated remote attacker could craft a link that causes a victim to visit a trusted MISP instance and, after successful authentication, be redirected to an attacker-controlled external URL. This could be abused to increase the credibility of phishing attacks, redirect users to counterfeit login pages, or deliver attacker-controlled content from an untrusted domain. CWE-601 describes this weakness as accepting user-controlled input that specifies an external link and using it in a redirect, with phishing as a common consequence.
The patch mitigates the issue by decoding and parsing the URL, rejecting URLs with a scheme, host, user component, missing or non-local path, and protocol-relative forms such as //example.com and /\example.com.
AnalysisAI
Open redirect in MISP versions up to and including 2.5.38 allows unauthenticated remote attackers to craft links that silently redirect victims to attacker-controlled external URLs immediately after successful authentication. The vulnerability resides in UsersController::routeafterlogin(), where the pre_login_requested_url session value was reflected into a Location header without enforcing local-path constraints. SSVC signals exploitation as 'none' and no CISA KEV listing exists, but the automatable designation and the high-trust context of a threat intelligence platform make this a meaningful phishing amplifier against security teams who would not expect a trusted MISP login to forward them off-site.
Technical ContextAI
MISP (Malware Information Sharing Platform) is an open-source threat intelligence platform developed and maintained by CIRCL. The vulnerable code path is in app/Controller/UsersController.php, specifically the private _postlogin() method, which reads a URL stored in the pre_login_requested_url session key and issues a redirect to it without validating whether it points to a local application path. CWE-601 (URL Redirection to Untrusted Site) is the root cause class: user-influenced input - in this case a URL embedded in the login request - is used directly as the redirect destination. The session key can be populated by an attacker simply by constructing a MISP URL that encodes an external target, since the platform stores the originally requested URL for post-login forwarding. Protocol-relative forms such as //attacker.com and /\attacker.com were additionally exploitable, meaning simple scheme-check bypasses were possible prior to the fix. Affected product CPE is cpe:2.3:a:misp:misp:*:*:*:*:*:*:*:* for all versions up to 2.5.38.
RemediationAI
The primary fix is to upgrade MISP to a version incorporating commit ae760b7bf534f2798810d59a1f961b31adb3443e, which patches app/Controller/UsersController.php to decode the stored URL with rawurldecode(), parse it with parse_url(), and reject any URL that contains a host, scheme, or user component, lacks a path, has a path that does not start with '/', or begins with '//' or '/\' (protocol-relative bypass forms). The patch reference is https://github.com/MISP/MISP/commit/ae760b7bf534f2798810d59a1f961b31adb3443e. The exact first patched release version is not independently confirmed beyond the commit - administrators should verify their installed version against git history or await an official tagged release announcement from CIRCL. As a compensating control where immediate upgrade is not possible, security teams could configure a web application firewall or reverse proxy rule to reject requests to the MISP login endpoint where query parameters or referrer headers contain absolute URLs or protocol-relative paths - note this may interfere with legitimate deep-link login flows and requires careful testing. User awareness training for MISP operators about unexpected post-login redirects is low-cost and provides marginal but real defense-in-depth.
More in Open Redirect
View allA malicious third-party can give a crafted "ssh://..." URL to an unsuspecting victim, and an attempt to visit the URL ca
GFI Kerio Control versions 9.2.5 through 9.4.5 contain an HTTP response splitting vulnerability in the dest parameter of
PHP through 7.0.8 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect
Multiple open redirect vulnerabilities in Apache Struts 2.0.0 through 2.3.15 allow remote attackers to redirect users to
Open redirect vulnerability in age-verification.php in the Age Verification plugin 0.4 and earlier for WordPress allows
Open redirect vulnerability in Kaseya Virtual System Administrator (VSA) 7.x before 7.0.0.29, 8.x before 8.0.0.18, 9.0 b
Vulnerability in the Oracle Applications Framework component of Oracle E-Business Suite (subcomponent: Popup windows (li
Unspecified vulnerability in the Oracle Application Server Single Sign-On component in Oracle Fusion Middleware 10.1.4.3
Flarum is open source discussion platform software. Rated medium severity (CVSS 6.5), this vulnerability is remotely exp
Open redirect vulnerability in Novius OS 5.0.1 (Elche) allows remote attackers to redirect users to arbitrary web sites
Open redirect vulnerability in the Redirect function in stageshow_redirect.php in the StageShow plugin before 5.0.9 for
Nteract v.0.28.0 was discovered to contain a remote code execution (RCE) vulnerability via the Markdown link. Rated crit
Share
External POC / Exploit Code
Leaving vuln.today