EUVD-2026-45998Severity by source
AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N
Network API reachable with low complexity but needs a low-privileged account (PR:L) and a victim click (UI:R); token capture enables account takeover, so C:H/I:H, no availability impact.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
2DescriptionCVE.org
dataCycle is a data management system for centrally storing, managing, searching, finding, and distributing data. In dataCycle-CORE, the module handling core processing and framework rules, before and including version 25.07.3, a low-privileged authenticated API user can supply forwardToUrl and redirectUrl values when triggering password reset or confirmation flows. Those values are then embedded into the outgoing email workflow without host allowlisting. This creates two related abuse paths:
- password reset or confirmation links can be sent to a victim with the token already attached to an attacker-controlled
forwardToUrl - after a legitimate password reset completes, the browser is redirected to attacker-controlled
redirectUrl
In practice, this can be used for phishing, token capture, confirmation hijacking, or steering a victim from a trusted email into an attacker domain. This is patched in version 26.06.08.
AnalysisAI
Open redirect and token-theft in dataCycle-CORE (all versions up to and including 25.07.3) lets a low-privileged authenticated API user inject attacker-controlled forwardToUrl and redirectUrl parameters into password-reset and confirmation email flows, which lack host allowlisting. Because a live reset/confirmation token can be appended to an attacker-controlled destination, and users are redirected off-site after completing a reset, an attacker can capture tokens, hijack confirmations, and stage convincing phishing from a trusted-domain email. No public exploit or CISA KEV listing exists at time of analysis; the issue is fixed in 26.06.08.
Technical ContextAI
The flaw is classified CWE-601 (URL Redirection to Untrusted Site, 'Open Redirect'). dataCycle-CORE is the Ruby/Rails core engine (CPE cpe:2.3:a:datacycle-engine:datacycle-core) that handles core processing and framework rules, including the account lifecycle email workflow. When triggering password-reset or confirmation flows, the API accepts caller-supplied forwardToUrl and redirectUrl values and embeds them directly into the outgoing email and post-reset browser redirect without validating them against an allowlist of trusted hosts. The root cause is missing destination-host validation on user-controllable redirect parameters, compounded by the fact that a sensitive one-time token is attached to the untrusted URL - turning a classic open redirect into a token-exfiltration primitive.
RemediationAI
Vendor-released patch: upgrade dataCycle-CORE to version 26.06.08, which adds host validation to the reset/confirmation email workflow; this is the primary and recommended fix (see advisory GHSA-8jfx-wpjg-hf38 at https://github.com/datacycle-engine/dataCycle-CORE/security/advisories/GHSA-8jfx-wpjg-hf38). If immediate upgrade is not possible, apply compensating controls: enforce a server-side allowlist of trusted destination hosts for forwardToUrl and redirectUrl (rejecting or stripping any external host), which fully neutralizes the abuse but may break legitimate integrations that rely on custom redirect targets; alternatively, ignore/override caller-supplied redirect parameters in the reset and confirmation endpoints and fall back to a fixed internal URL, at the cost of any intended multi-tenant redirect behavior. Additionally, tighten who can obtain the low-privileged API accounts needed to invoke these flows, and monitor outbound reset/confirmation emails for external redirect hosts.
More in Open Redirect
View allA malicious third-party can give a crafted "ssh://..." URL to an unsuspecting victim, and an attempt to visit the URL ca
GFI Kerio Control versions 9.2.5 through 9.4.5 contain an HTTP response splitting vulnerability in the dest parameter of
PHP through 7.0.8 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect
Multiple open redirect vulnerabilities in Apache Struts 2.0.0 through 2.3.15 allow remote attackers to redirect users to
Open redirect vulnerability in age-verification.php in the Age Verification plugin 0.4 and earlier for WordPress allows
Open redirect vulnerability in Kaseya Virtual System Administrator (VSA) 7.x before 7.0.0.29, 8.x before 8.0.0.18, 9.0 b
Vulnerability in the Oracle Applications Framework component of Oracle E-Business Suite (subcomponent: Popup windows (li
Unspecified vulnerability in the Oracle Application Server Single Sign-On component in Oracle Fusion Middleware 10.1.4.3
Flarum is open source discussion platform software. Rated medium severity (CVSS 6.5), this vulnerability is remotely exp
Open redirect vulnerability in Novius OS 5.0.1 (Elche) allows remote attackers to redirect users to arbitrary web sites
Open redirect vulnerability in the Redirect function in stageshow_redirect.php in the StageShow plugin before 5.0.9 for
Nteract v.0.28.0 was discovered to contain a remote code execution (RCE) vulnerability via the Markdown link. Rated crit
Share
External POC / Exploit Code
Leaving vuln.today