Diem CVE-2026-112040

Exploitation targets the Sign-In component of Diem, specifically the handling of the Referer argument in dmCorePlugin/plugins/dmUserPlugin/modules/dmUser/lib/BasedmUserActions.class.php, which is used unsanitized to build a post-authentication redirect. The attacker needs no authentication (PR:N) and no special configuration, but a victim must actively follow the attacker-crafted link (UI:P) - this required user interaction is the main limiting factor. Impact is confined to redirecting the browser to an external site (integrity-only); it does not grant server access or data disclosure.

This is a low-priority issue that the inputs consistently characterize as minor, with no conflicting signals inflating its importance. The CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:P) describes a remotely reachable, low-complexity, unauthenticated flaw, but the only impact is a limited integrity effect (VI:L) with no confidentiality or availability impact (VC:N/VA:N) - consistent with an open redirect (CWE-601), which redirects a victim to an attacker-chosen site rather than compromising the server. The resulting score of 2.1 is correctly low. Exploitation requires victim interaction (UI:P), i.e. a user must click a crafted link, which is the primary factor limiting real-world impact. POC availability is confirmed (publicly disclosed via the GitHub issue), and the CVSS 4.0 exploit maturity is E:P (proof-of-concept), matching that signal. EPSS is not provided in the input, and the vulnerability is NOT on CISA KEV, so there is no evidence of active exploitation - only a public POC. Note the data originates solely from VulDB with no independent vendor advisory, and the product uses a rolling-release model so no fixed version exists; treat affected-version scope as unresolved. Bottom line: a genuine but low-severity open redirect best suited for phishing/credential-harvesting assistance, not a patch-now emergency.

An attacker crafts a malicious URL to the Diem sign-in flow that manipulates the Referer argument so that, after interaction, the victim is redirected to an attacker-controlled site. A publicly disclosed POC exists (via the project's GitHub issue tracker), and because the flaw requires the victim to follow a crafted link (UI:P), it is most useful for phishing - presenting a trusted Diem domain that silently forwards users to a credential-harvesting or malware page.