Open Redirect
CVE-2026-28681
HIGH
GHSA-22m3-c7vp-49fj
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
Primary rating from GitHub Advisory · only source for this CVE.
CVSS VectorGitHub Advisory
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
Lifecycle Timeline
5DescriptionGitHub Advisory
Internet Routing Registry daemon version 4 is an IRR database server, processing IRR objects in the RPSL format. From version 4.4.0 to before version 4.4.5 and from version 4.5.0 to before version 4.5.1, an attacker can manipulate the HTTP Host header on a password reset or account creation request. The confirmation link in the resulting email can then point to an attacker-controlled domain. Opening the link in the email is sufficient to pass the token to the attacker, who can then use it on the real IRRD instance to take over the account. A compromised account can then be used to modify RPSL objects maintained by the account's mntners and perform other account actions. If the user had two-factor authentication configured, which is required for users with override access, an attacker is not able to log in, even after successfully resetting the password. This issue has been patched in versions 4.4.5 and 4.5.1.
AnalysisAI
Host header injection in Internet Routing Registry daemon (IRRd) 4.4.0-4.4.4 and 4.5.0 allows remote attackers to redirect password reset and account creation confirmation links to attacker-controlled domains, enabling account takeover of IRR database maintainer accounts. Successfully exploited accounts can modify routing policy objects (RPSL) in the IRR database. EPSS score of 0.06% (18th percentile) indicates low predicted exploitation probability. Vendor patches available in versions 4.4.5 and 4.5.1.
Technical ContextAI
Internet Routing Registry daemon (IRRd) is a database server for managing Internet Routing Registry (IRR) objects in RPSL (Routing Policy Specification Language) format, used by network operators to document routing policies and AS relationships. This vulnerability stems from CWE-601 (URL Redirection to Untrusted Site), specifically Host header injection during user authentication workflows. The application trusts the HTTP Host header when constructing confirmation URLs for password resets and new account registrations. By manipulating this header, attackers can cause the application to generate email links pointing to their infrastructure while containing valid authentication tokens. The affected component is the web interface's email generation logic in IRRd 4.x series. The vulnerability affects the authentication and authorization subsystem responsible for managing maintainer (mntner) accounts, which have privileged access to modify routing policy objects in the IRR database.
RemediationAI
Upgrade to Internet Routing Registry daemon version 4.4.5 (for 4.4.x branch) or version 4.5.1 (for 4.5.x branch), which contain patches addressing the Host header injection vulnerability. Release notes available at https://irrd.readthedocs.io/en/stable/releases/4.4.5 and https://irrd.readthedocs.io/en/stable/releases/4.5.1 document the fixes. Patch commits cf62df4a49d3891e80b2879d9b324d1af050000c and 8408e0f1b9f47eb2f2e712d6153e32194df05fbb show the technical remediation implemented by the vendor. If immediate patching is not feasible, implement compensating controls: configure web application firewall (WAF) or reverse proxy to validate and normalize Host headers to only accept legitimate domain names for the IRRd instance, though this may break legitimate multi-domain deployments; enforce mandatory two-factor authentication for all maintainer accounts to limit impact of successful password resets (note this prevents attackers from completing login but does not prevent password changes); monitor email logs and user account activity for suspicious password reset patterns or registration attempts from unexpected IP addresses. These workarounds reduce but do not eliminate risk and should be considered temporary pending upgrade.
More in Open Redirect
View allA malicious third-party can give a crafted "ssh://..." URL to an unsuspecting victim, and an attempt to visit the URL ca
GFI Kerio Control versions 9.2.5 through 9.4.5 contain an HTTP response splitting vulnerability in the dest parameter of
PHP through 7.0.8 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect
Multiple open redirect vulnerabilities in Apache Struts 2.0.0 through 2.3.15 allow remote attackers to redirect users to
Open redirect vulnerability in age-verification.php in the Age Verification plugin 0.4 and earlier for WordPress allows
Open redirect vulnerability in Kaseya Virtual System Administrator (VSA) 7.x before 7.0.0.29, 8.x before 8.0.0.18, 9.0 b
Vulnerability in the Oracle Applications Framework component of Oracle E-Business Suite (subcomponent: Popup windows (li
Unspecified vulnerability in the Oracle Application Server Single Sign-On component in Oracle Fusion Middleware 10.1.4.3
Flarum is open source discussion platform software. Rated medium severity (CVSS 6.5), this vulnerability is remotely exp
Open redirect vulnerability in Novius OS 5.0.1 (Elche) allows remote attackers to redirect users to arbitrary web sites
Open redirect vulnerability in the Redirect function in stageshow_redirect.php in the StageShow plugin before 5.0.9 for
Nteract v.0.28.0 was discovered to contain a remote code execution (RCE) vulnerability via the Markdown link. Rated crit
Share
External POC / Exploit Code
Leaving vuln.today