kodbox CVE-2026-18721

Exploitation requires that the SSO API Login feature be enabled and the /user/sso/apiLogin endpoint be network-accessible. No attacker authentication is required (PR:N in the CVSS 4.0 vector). The vulnerability is triggered by supplying an arbitrary external URL in the callbackUrl parameter without any other precondition - AT:N confirms no special attack prerequisites apply. A victim must follow the crafted link (UI:P - passive user interaction), meaning the attacker must successfully deliver the URL through phishing, social engineering, or a secondary injection vector; exploitation cannot occur without a user taking action on the malicious link. Deployments that restrict access to /user/sso/apiLogin to internal IP ranges, disable SSO entirely, or enforce callbackUrl validation at the WAF layer are not exploitable via this vector. The vulnerability is limited to kodbox 1.67 Build 02 as confirmed; exploitation against other versions is plausible but unconfirmed from available data.

The CVSS 4.0 score of 5.3 (Medium) accurately reflects the bounded direct technical impact: the vulnerable system itself sustains only low integrity loss (VI:L) with no confidentiality or availability impact (VC:N/VA:N). However, raw CVSS understates the real-world risk of open redirects in SSO contexts - the primary threat is social-engineering amplification, where attackers leverage the trusted kodbox domain to bypass user suspicion and harvest credentials or session tokens from SSO-integrated services. PR:N confirms no attacker authentication is required, and AT:N means no special configuration or precondition is needed on the attacker's side. The public POC on GitHub (captured by the E:P supplemental metric) materially lowers exploitation complexity. No EPSS score was provided in the input data, so exploitation probability cannot be quantified statistically; this is a gap in the available intelligence. The absence of a CISA KEV listing suggests no confirmed mass exploitation, though the vendor's failure to respond to disclosure means no coordinated patch exists, leaving all deployed instances in a permanent unpatched state until the vendor acts.

An attacker crafts a URL targeting the kodbox SSO endpoint with a malicious external domain injected into the callbackUrl parameter - for example, https://kodbox.example.com/user/sso/apiLogin?callbackUrl=https://attacker.com/fake-login - and distributes it via phishing email or internal chat, exploiting the trusted kodbox domain to bypass user scrutiny. When the victim follows the link and the SSO flow initiates, the unvalidated server-side redirect sends the user to the attacker-controlled site, which mimics the organization's login portal to harvest credentials or OAuth tokens. A public proof-of-concept demonstrating this technique is available at https://github.com/sjmycz/cve/issues/6, meaning any motivated attacker can replicate the attack with minimal effort.