EUVD-2026-44944
GHSA-qwf3-2mwh-ccxc
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:M/U:X
Attack is delivered via network URL (AV:N contradicts vendor AV:L); user interaction mandatory (UI:R); confidentiality impact is indirect phishing risk, not direct exfiltration (C:L).
Primary rating from Vendor (TQtC).
CVSS VectorVendor: TQtC
Lifecycle Timeline
1DescriptionCVE.org
An Open Redirect vulnerability (CWE-601) exists in the OAuth/OIDC authentication implementation of the Axivion Dashboard. The login flow did not properly restrict the post-authentication redirect to the application's own origin, so a user who follows a crafted login link can be sent to an untrusted external site after authenticating against the genuine Dashboard. Because the link points at the legitimate Dashboard, this can be abused for phishing, for example credential or second-factor theft via a convincing look-alike page. Exploitation requires the victim to follow the attacker-supplied link and complete the authentication flow.
AnalysisAI
Open redirect in Axivion Dashboard's OAuth/OIDC login flow allows an attacker to silently redirect an authenticated user to an arbitrary external URL after successful sign-in. All Axivion versions are affected per the wildcard CPE (cpe:2.3:a:qt:axivion:*). A threat actor can exploit this for phishing - credential harvesting or second-factor theft - by embedding a crafted login URL that terminates on a convincing look-alike site rather than the legitimate dashboard. No public exploit has been identified at time of analysis and the vulnerability is not listed in CISA KEV.
Technical ContextAI
The flaw resides in the post-authentication redirect logic of Axivion Dashboard's OAuth/OIDC integration (CWE-601: URL Redirection to Untrusted Site). RFC 6819 and OIDC Core require that redirect_uri values be validated against a strict allowlist of pre-registered URIs; the dashboard failed to enforce origin-binding, permitting an attacker-controlled destination to be embedded in the login link. Axivion is a Qt Company (TQtC) software quality and architecture analysis platform, commonly deployed in safety-critical and embedded software development environments. The CPE wildcard (cpe:2.3:a:qt:axivion:*:*:*:*:*:*:*:*) indicates all tracked versions are affected, and no version-bounded CPE range has been published.
RemediationAI
Patch available per vendor advisory at https://wiki.qt.io/List_of_known_vulnerabilities_in_Qt_products#CVE-2026-12379; however, an exact fixed release version is not independently confirmed from the available data - consult the Qt/Axivion vendor page directly to identify the patched build. As a compensating control, restrict the Axivion Dashboard to internal network access only and enforce strict egress filtering so that post-authentication redirects to external domains are blocked at the network layer; this reduces phishing delivery surface without patching but does not eliminate the vulnerability if attackers are already on the internal network. Additionally, user awareness of phishing using legitimate-looking login URLs should be communicated to Axivion users, particularly warning that the post-login destination should always be the internal dashboard URL.
More in Open Redirect
View allA malicious third-party can give a crafted "ssh://..." URL to an unsuspecting victim, and an attempt to visit the URL ca
GFI Kerio Control versions 9.2.5 through 9.4.5 contain an HTTP response splitting vulnerability in the dest parameter of
PHP through 7.0.8 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect
Multiple open redirect vulnerabilities in Apache Struts 2.0.0 through 2.3.15 allow remote attackers to redirect users to
Open redirect vulnerability in age-verification.php in the Age Verification plugin 0.4 and earlier for WordPress allows
Open redirect vulnerability in Kaseya Virtual System Administrator (VSA) 7.x before 7.0.0.29, 8.x before 8.0.0.18, 9.0 b
Vulnerability in the Oracle Applications Framework component of Oracle E-Business Suite (subcomponent: Popup windows (li
Unspecified vulnerability in the Oracle Application Server Single Sign-On component in Oracle Fusion Middleware 10.1.4.3
Flarum is open source discussion platform software. Rated medium severity (CVSS 6.5), this vulnerability is remotely exp
Open redirect vulnerability in Novius OS 5.0.1 (Elche) allows remote attackers to redirect users to arbitrary web sites
Open redirect vulnerability in the Redirect function in stageshow_redirect.php in the StageShow plugin before 5.0.9 for
Nteract v.0.28.0 was discovered to contain a remote code execution (RCE) vulnerability via the Markdown link. Rated crit
Share
External POC / Exploit Code
Leaving vuln.today