EUVD-2026-38759
GHSA-wfgr-g7h2-c6m6
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-exploitable open redirect with no auth (PR:N); scope changes to victim browser (S:C); user must click link (UI:R); low integrity impact only, no confidentiality or availability impact.
Primary rating from Vendor (Secur0).
CVSS VectorVendor: Secur0
Lifecycle Timeline
2DescriptionCVE.org
Open redirect vulnerability (CWE-601) in the _safe_redirect function of the click-tracking endpoint (/c/<token>/) in Mailerup <1.0.0 on all platforms allows remote unauthenticated attackers to redirect victims to arbitrary external sites and conduct phishing attacks via a crafted u query parameter, because the URL scheme is validated (blocking javascript: and data:) but the destination host is not restricted to an allowlist, and a signing.BadSignature exception is silently caught so a valid signed token is not required.
AnalysisAI
Open redirect in Mailerup's click-tracking endpoint allows remote unauthenticated attackers to redirect victims to arbitrary external domains by supplying a crafted u query parameter to /c/<token>/. The _safe_redirect function blocks only javascript: and data: schemes without restricting the destination host, and silently swallows signing.BadSignature exceptions - making token validation entirely bypassable. No CISA KEV listing or public exploit code has been identified; exploitation requires victim interaction but no attacker authentication against the Mailerup instance.
Technical ContextAI
Mailerup is a self-hosted Django/Python email marketing platform. Its click-tracking endpoint /c/<token>/ is designed to log subscriber link activity before redirecting them to intended campaign destinations. CWE-601 (URL Redirection to Untrusted Site) applies: the _safe_redirect function performs incomplete URL validation - it checks the URL scheme to block javascript: and data: URIs but applies no allowlist or domain restriction to the redirect target host. A second, compounding defect is that the cryptographic token signature check (signing.BadSignature) is caught and silently discarded, removing the only gating mechanism that could limit who can trigger the redirect. Affected products per CPE: cpe:2.3:a:mailerup:mailerup:*:*:*:*:*:*:*:* (all versions prior to 1.0.0, all platforms). The upstream fix commit (99eb6d4586134bf3f4422093fbf47d6794ef0ee5) also patches an unescaped subscriber email reflected into HTML (XSS) and removes the public registration endpoint - indicating the same release addressed multiple security issues simultaneously.
RemediationAI
Apply the upstream patch from commit 99eb6d4586134bf3f4422093fbf47d6794ef0ee5 (https://github.com/Maalfer/mailerup/commit/99eb6d4586134bf3f4422093fbf47d6794ef0ee5), which corrects the _safe_redirect function to properly restrict redirect destinations. A specific patched release version number was not confirmed in the available data - operators should pull the latest commit from the main branch and redeploy the backend. As an interim workaround before patching, a reverse proxy or WAF rule can be configured to block or reject requests to /c/ that include a u parameter with an external (non-allowlisted) hostname; the trade-off is that this may disrupt legitimate click tracking if not carefully scoped to known campaign domains. An alternative interim control is to restrict public network access to the /c/<token>/ endpoint entirely, though this disables click-tracking functionality for all subscribers. The same commit also resolves a reflected XSS in the subscriber email field and removes the public registration endpoint - all three fixes should be applied together.
More in Open Redirect
View allA malicious third-party can give a crafted "ssh://..." URL to an unsuspecting victim, and an attempt to visit the URL ca
GFI Kerio Control versions 9.2.5 through 9.4.5 contain an HTTP response splitting vulnerability in the dest parameter of
PHP through 7.0.8 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect
Multiple open redirect vulnerabilities in Apache Struts 2.0.0 through 2.3.15 allow remote attackers to redirect users to
Open redirect vulnerability in age-verification.php in the Age Verification plugin 0.4 and earlier for WordPress allows
Open redirect vulnerability in Kaseya Virtual System Administrator (VSA) 7.x before 7.0.0.29, 8.x before 8.0.0.18, 9.0 b
Vulnerability in the Oracle Applications Framework component of Oracle E-Business Suite (subcomponent: Popup windows (li
Unspecified vulnerability in the Oracle Application Server Single Sign-On component in Oracle Fusion Middleware 10.1.4.3
Flarum is open source discussion platform software. Rated medium severity (CVSS 6.5), this vulnerability is remotely exp
Open redirect vulnerability in Novius OS 5.0.1 (Elche) allows remote attackers to redirect users to arbitrary web sites
Open redirect vulnerability in the Redirect function in stageshow_redirect.php in the StageShow plugin before 5.0.9 for
Nteract v.0.28.0 was discovered to contain a remote code execution (RCE) vulnerability via the Markdown link. Rated crit
Share
External POC / Exploit Code
Leaving vuln.today