EUVD-2026-45299
GHSA-gpmm-f3qc-3qgj
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Network-accessible open redirect requires only a victim click (UI:R); no server privileges needed; confidentiality impact is low, limited to phishing-facilitated credential risk.
Primary rating from Vendor (ibm).
CVSS VectorVendor: ibm
Lifecycle Timeline
1DescriptionCVE.org
IBM Engineering AI Hub 1.0.0, 1.1.0, and 1.2.0 could allow a remote attacker to redirect users to malicious websites due to improper validation of user-supplied URLs.
AnalysisAI
IBM Engineering AI Hub versions 1.0.0, 1.1.0, and 1.2.0 expose an open redirect flaw (CWE-601) that enables remote attackers to silently redirect authenticated or unauthenticated users to arbitrary attacker-controlled websites by supplying a crafted URL. The vulnerability requires no privileges but does require user interaction, making it a phishing-enablement risk rather than a direct system compromise vector. No public exploit code or CISA KEV listing exists at time of analysis; IBM has released a patch per advisory https://www.ibm.com/support/pages/node/7279964.
Technical ContextAI
CWE-601 (URL Redirection to Untrusted Site) arises when an application accepts a user-supplied URL parameter and performs an HTTP redirect without validating that the target is within an allowlist of trusted destinations. IBM Engineering AI Hub - IBM's AI-driven engineering lifecycle platform - fails to perform this validation, allowing the redirect target to be arbitrarily controlled by the requester. The affected scope per CPE is cpe:2.3:a:ibm:engineering_ai_hub:*:*:*:*:*:*:*:* across all variants of versions 1.0.0, 1.1.0, and 1.2.0. Open redirects are commonly weaponized to add legitimacy to phishing campaigns by hosting the initial link on a trusted organizational domain (in this case, an IBM Engineering AI Hub endpoint), before silently forwarding the victim to a credential-harvesting site.
RemediationAI
Apply the vendor-released patch per IBM security advisory https://www.ibm.com/support/pages/node/7279964. The exact patched version is not specified in the available data - consult the advisory directly to confirm the target upgrade version. If immediate patching is not possible, a compensating control is to deploy a web application firewall or reverse proxy rule that inspects and blocks redirect parameters pointing to external domains, enforcing an allowlist of trusted internal hostnames; note this may break legitimate cross-system redirect flows and should be tested carefully. Additionally, user awareness communications warning staff not to click unexpected links using the IBM Engineering AI Hub domain can reduce phishing exposure in the interim.
More in Open Redirect
View allA malicious third-party can give a crafted "ssh://..." URL to an unsuspecting victim, and an attempt to visit the URL ca
GFI Kerio Control versions 9.2.5 through 9.4.5 contain an HTTP response splitting vulnerability in the dest parameter of
PHP through 7.0.8 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect
Multiple open redirect vulnerabilities in Apache Struts 2.0.0 through 2.3.15 allow remote attackers to redirect users to
Open redirect vulnerability in age-verification.php in the Age Verification plugin 0.4 and earlier for WordPress allows
Open redirect vulnerability in Kaseya Virtual System Administrator (VSA) 7.x before 7.0.0.29, 8.x before 8.0.0.18, 9.0 b
Vulnerability in the Oracle Applications Framework component of Oracle E-Business Suite (subcomponent: Popup windows (li
Unspecified vulnerability in the Oracle Application Server Single Sign-On component in Oracle Fusion Middleware 10.1.4.3
Flarum is open source discussion platform software. Rated medium severity (CVSS 6.5), this vulnerability is remotely exp
Open redirect vulnerability in Novius OS 5.0.1 (Elche) allows remote attackers to redirect users to arbitrary web sites
Open redirect vulnerability in the Redirect function in stageshow_redirect.php in the StageShow plugin before 5.0.9 for
Nteract v.0.28.0 was discovered to contain a remote code execution (RCE) vulnerability via the Markdown link. Rated crit
Share
External POC / Exploit Code
Leaving vuln.today