EUVD-2026-38221Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attacker requires no authentication to craft the redirect URL; UI:R because victim must click and authenticate; integrity-only impact via deceptive redirect with no server-side data exposure.
Primary rating from Vendor (rami.io).
CVSS VectorVendor: rami.io
Lifecycle Timeline
1DescriptionCVE.org
An unvalidated redirect was contained in Venueless' social login functionality and could be exploited for phishing using trusted domains.
AnalysisAI
Unvalidated redirect in Venueless social login allows phishing attacks by abusing the trusted domain reputation of legitimate event platform instances. Any Venueless deployment with social login enabled is affected across all tracked versions (CPE wildcard), and an attacker can craft a social login URL embedding an arbitrary external redirect destination that executes silently after a victim completes OAuth authentication. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog, but the low attack complexity and authentication-flow context make this a credible phishing vector against event attendees and organizers.
Technical ContextAI
Venueless (CPE: cpe:2.3:a:pretix:venueless:*:*:*:*:*:*:*:*) is an open-source virtual event platform maintained by the pretix organization. The vulnerability is rooted in CWE-601 (URL Redirection to Untrusted Site), a failure to validate or allowlist the post-authentication redirect target within the social login (OAuth) flow. OAuth and social login implementations commonly accept a redirect_uri or 'next' parameter that specifies where to send the user after successful authentication; if this parameter is not restricted to a validated set of same-origin paths or trusted destinations, an attacker can inject an arbitrary external URL. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:P) confirms the attack is network-deliverable with low complexity, requires passive user interaction, and carries low integrity impact on both the vulnerable and a subsequent system - consistent with phishing redirect rather than direct data exfiltration.
RemediationAI
The primary remediation is to upgrade Venueless to the patched version identified in the GitHub Security Advisory at https://github.com/venueless/venueless/security/advisories/GHSA-m87f-7c4r-w4p3; the exact fixed version number was not present in the provided intelligence and must be confirmed directly from that advisory before deployment. If an immediate upgrade is not feasible, a targeted compensating control is to implement strict server-side validation of the post-login redirect parameter against an explicit allowlist of trusted same-origin relative paths - any absolute URL pointing to an external host should be rejected and the user redirected to the default landing page instead. As an interim measure, operators may consider disabling social login functionality entirely on publicly exposed instances if the advisory confirms no non-upgrade workaround exists; this eliminates the vulnerable code path at the cost of requiring users to authenticate via alternative means. Note that an allowlist-based redirect filter may break legitimate deep-link or third-party integration flows if those destinations are not explicitly enumerated, so test thoroughly before applying in production.
More in Open Redirect
View allA malicious third-party can give a crafted "ssh://..." URL to an unsuspecting victim, and an attempt to visit the URL ca
GFI Kerio Control versions 9.2.5 through 9.4.5 contain an HTTP response splitting vulnerability in the dest parameter of
PHP through 7.0.8 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect
Multiple open redirect vulnerabilities in Apache Struts 2.0.0 through 2.3.15 allow remote attackers to redirect users to
Open redirect vulnerability in age-verification.php in the Age Verification plugin 0.4 and earlier for WordPress allows
Open redirect vulnerability in Kaseya Virtual System Administrator (VSA) 7.x before 7.0.0.29, 8.x before 8.0.0.18, 9.0 b
Vulnerability in the Oracle Applications Framework component of Oracle E-Business Suite (subcomponent: Popup windows (li
Unspecified vulnerability in the Oracle Application Server Single Sign-On component in Oracle Fusion Middleware 10.1.4.3
Flarum is open source discussion platform software. Rated medium severity (CVSS 6.5), this vulnerability is remotely exp
Open redirect vulnerability in Novius OS 5.0.1 (Elche) allows remote attackers to redirect users to arbitrary web sites
Open redirect vulnerability in the Redirect function in stageshow_redirect.php in the StageShow plugin before 5.0.9 for
Nteract v.0.28.0 was discovered to contain a remote code execution (RCE) vulnerability via the Markdown link. Rated crit
Share
External POC / Exploit Code
Leaving vuln.today