EUVD-2026-15184
GHSA-hff5-rpfp-7hc7
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Lifecycle Timeline
4DescriptionCVE.org
Open Redirect vulnerability in Hitachi Ops Center Administrator.This issue affects Hitachi Ops Center Administrator: from 10.2.0 before 11.0.8.
AnalysisAI
An Open Redirect vulnerability exists in Hitachi Ops Center Administrator versions 10.2.0 through 11.0.7, allowing unauthenticated attackers to redirect users to arbitrary external websites through a crafted URL. The vulnerability requires user interaction (clicking a malicious link) but can be leveraged for phishing attacks, credential harvesting, or malware distribution. There is no indication of active exploitation in the wild or public proof-of-concept availability at this time.
Technical ContextAI
Open Redirect vulnerabilities (CWE-601) occur when an application accepts user-controlled input to determine redirect destinations without proper validation or sanitization. In Hitachi Ops Center Administrator, this likely occurs in URL parameter handling within the web interface, where the application fails to validate that redirect targets are internal or whitelisted. The affected product (cpe:2.3:a:hitachi:hitachi_ops_center_administrator) is an enterprise IT systems management platform; the vulnerability resides in its web-based administrative interface. The root cause is insufficient input validation on redirect parameters, allowing attackers to craft URLs that appear legitimate (originating from a trusted Hitachi domain) but redirect to attacker-controlled destinations.
RemediationAI
Upgrade Hitachi Ops Center Administrator to version 11.0.8 or later, which contains the fix for this open redirect vulnerability. Consult the official Hitachi security advisory at https://www.hitachi.com/products/it/software/security/info/vuls/hitachi-sec-2026-113/index.html for specific upgrade procedures. As an interim mitigation, restrict network access to the Hitachi Ops Center Administrator web interface to trusted internal networks and IP ranges, disable external internet access where possible, and educate administrative users about the risks of clicking links in unsolicited emails or messages. Implement web application firewall rules to detect and block suspicious redirect parameters if immediate patching is not feasible.
More in Open Redirect
View allA malicious third-party can give a crafted "ssh://..." URL to an unsuspecting victim, and an attempt to visit the URL ca
GFI Kerio Control versions 9.2.5 through 9.4.5 contain an HTTP response splitting vulnerability in the dest parameter of
PHP through 7.0.8 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect
Multiple open redirect vulnerabilities in Apache Struts 2.0.0 through 2.3.15 allow remote attackers to redirect users to
Open redirect vulnerability in age-verification.php in the Age Verification plugin 0.4 and earlier for WordPress allows
Open redirect vulnerability in Kaseya Virtual System Administrator (VSA) 7.x before 7.0.0.29, 8.x before 8.0.0.18, 9.0 b
Vulnerability in the Oracle Applications Framework component of Oracle E-Business Suite (subcomponent: Popup windows (li
Unspecified vulnerability in the Oracle Application Server Single Sign-On component in Oracle Fusion Middleware 10.1.4.3
Flarum is open source discussion platform software. Rated medium severity (CVSS 6.5), this vulnerability is remotely exp
Open redirect vulnerability in Novius OS 5.0.1 (Elche) allows remote attackers to redirect users to arbitrary web sites
Open redirect vulnerability in the Redirect function in stageshow_redirect.php in the StageShow plugin before 5.0.9 for
Nteract v.0.28.0 was discovered to contain a remote code execution (RCE) vulnerability via the Markdown link. Rated crit
Share
External POC / Exploit Code
Leaving vuln.today