EUVD-2026-52570
GHSA-f83r-6hq8-m7vj
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-accessible pre-auth SSO endpoint (AV:N/PR:N); victim must click crafted link (UI:R); impact is redirect only - no confidentiality loss and scope unchanged on the server.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
4DescriptionCVE.org
A vulnerability has been found in kalcaddle kodbox 1.67 Build 02. This issue affects some unknown processing of the file /user/sso/apiLogin of the component SSO API Login. The manipulation of the argument callbackUrl leads to open redirect. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
AnalysisAI
Open redirect in kodbox 1.67 Build 02 SSO API Login allows unauthenticated remote attackers to redirect victims to arbitrary external URLs by manipulating the callbackUrl parameter at the /user/sso/apiLogin endpoint. The CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:P) confirms network-accessible, low-complexity exploitation requiring only passive user interaction - a victim clicking a crafted SSO link - with no authentication or special configuration needed from the attacker's side. A proof-of-concept exploit has been publicly disclosed on GitHub (E:P), lowering the exploitation barrier, though no CISA KEV listing indicates confirmed widespread exploitation at time of analysis.
Technical ContextAI
kodbox (CPE: cpe:2.3:a:kalcaddle:kodbox:*:*:*:*:*:*:*:*) is a self-hosted file management and collaboration platform developed by kalcaddle. The vulnerability resides in its Single Sign-On API Login handler at /user/sso/apiLogin. CWE-601 (URL Redirection to Untrusted Site / Open Redirect) identifies the root cause: the application uses a user-supplied callbackUrl parameter to determine the post-authentication redirect destination without validating whether the URL belongs to a trusted or allowlisted domain. This vulnerability class is a well-understood but persistently dangerous pattern because it weaponizes the legitimacy of the hosting domain - the initial URL appears trustworthy to recipients since it is served from the victim organization's own kodbox instance - enabling effective phishing and credential harvesting campaigns against SSO-authenticated users.
RemediationAI
No vendor-released patch has been identified at time of analysis - the vendor did not respond to responsible disclosure, so no fixed version can be cited. As a primary compensating control, administrators should immediately implement a server-side allowlist for the callbackUrl parameter in the SSO API Login handler, rejecting any redirect target that does not match a pre-approved list of internal domains or paths; this eliminates the redirect vector without disabling SSO functionality. As a secondary control, operators can restrict access to the /user/sso/apiLogin endpoint at the reverse-proxy or WAF layer to known internal IP ranges, reducing the population of users who can receive and act on crafted links - note this may impact legitimate SSO flows for remote users and requires careful scope definition. If the SSO API Login feature is not operationally required, disabling it entirely eliminates the attack surface with no side effects beyond loss of SSO capability. Monitor VulDB (https://vuldb.com/vuln/385632) and the kalcaddle project repository for any future patch releases.
More in Open Redirect
View allA malicious third-party can give a crafted "ssh://..." URL to an unsuspecting victim, and an attempt to visit the URL ca
GFI Kerio Control versions 9.2.5 through 9.4.5 contain an HTTP response splitting vulnerability in the dest parameter of
PHP through 7.0.8 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect
Multiple open redirect vulnerabilities in Apache Struts 2.0.0 through 2.3.15 allow remote attackers to redirect users to
Open redirect vulnerability in age-verification.php in the Age Verification plugin 0.4 and earlier for WordPress allows
Open redirect vulnerability in Kaseya Virtual System Administrator (VSA) 7.x before 7.0.0.29, 8.x before 8.0.0.18, 9.0 b
Vulnerability in the Oracle Applications Framework component of Oracle E-Business Suite (subcomponent: Popup windows (li
Unspecified vulnerability in the Oracle Application Server Single Sign-On component in Oracle Fusion Middleware 10.1.4.3
Flarum is open source discussion platform software. Rated medium severity (CVSS 6.5), this vulnerability is remotely exp
Open redirect vulnerability in Novius OS 5.0.1 (Elche) allows remote attackers to redirect users to arbitrary web sites
Open redirect vulnerability in the Redirect function in stageshow_redirect.php in the StageShow plugin before 5.0.9 for
Nteract v.0.28.0 was discovered to contain a remote code execution (RCE) vulnerability via the Markdown link. Rated crit
Share
External POC / Exploit Code
Leaving vuln.today