EUVD-2026-28431Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from GitHub Advisory · only source for this CVE.
CVSS VectorGitHub Advisory
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
5Blast Radius
ecosystem impact- 2 npm packages depend on @saltcorn/server (2 direct, 0 indirect)
Ecosystem-wide dependent count for version 1.5.0-beta.0.
DescriptionGitHub Advisory
Saltcorn is an extensible, open source, no-code database application builder. Prior to versions 1.4.6, 1.5.6, and 1.6.0-beta.5, Saltcorn validates the post-login dest parameter with a string check that only blocks :/ and //. Because all WHATWG-compliant browsers normalise backslashes (\) to forward slashes (/) for special schemes, a payload such as /\evil.com/path slips through is_relative_url(), is emitted unchanged in the HTTP Location header, and causes the browser to navigate cross-origin to an attacker-controlled domain. The bug is reachable on a default install and only requires a victim who can be tricked into logging in via a crafted Saltcorn URL. This issue has been patched in versions 1.4.6, 1.5.6, and 1.6.0-beta.5.
AnalysisAI
Open redirect in Saltcorn's post-login destination parameter validation allows attackers to redirect authenticated users to attacker-controlled domains via backslash bypass. Versions prior to 1.4.6, 1.5.6, and 1.6.0-beta.5 are vulnerable because the is_relative_url() function only blocks ':/' and '//' but fails to account for WHATWG URL parsing, which normalizes backslashes to forward slashes in special schemes. An attacker can craft a malicious login URL with a dest parameter like /\evil.com/path that bypasses validation, passes through the Location header unencoded, and causes the victim's browser to navigate cross-origin after successful authentication. This requires user interaction (clicking a crafted link) but no special configuration and affects default installations.
Technical ContextAI
The vulnerability exists in the is_relative_url() validation function in packages/server/routes/utils.js, which uses a simplistic string check to distinguish same-origin redirects from cross-origin ones. Modern WHATWG-compliant browsers (Chrome, Firefox, Safari, Edge) normalize backslashes to forward slashes during URL parsing for special schemes including http, https, ftp, ws, and wss. When a URL like /\evil.com/path is provided to a browser with base context http://victim/, the WHATWG parser resolves it to http://evil.com/path. The vulnerable code path decodes the dest parameter twice (once by body-parser middleware, once by explicit decodeURIComponent), then passes it to Express's res.redirect(). Express 5 uses encodeurl 2.0.0, which does not percent-encode backslashes, leaving them verbatim in the Location header. The root cause is CWE-601 (URL Redirection to Untrusted Site, Open Redirect) - the allowlist validation is incomplete and does not account for browser URL normalization behavior. The Saltcorn application is written in Node.js/Express and packaged as npm/@saltcorn/server.
RemediationAI
Upgrade Saltcorn immediately to patched versions: 1.4.6, 1.5.6, or 1.6.0-beta.5 (or later stable release in the 1.6.x branch). The fix updates the is_relative_url() validation function to properly reject backslash characters and non-http(s) schemes before the redirect is emitted. For users unable to patch immediately, implement network-layer compensating controls: configure a Web Application Firewall (WAF) to block POST /auth/login requests where the dest parameter contains backslash characters (\) or non-http(s) URI schemes (javascript:, data:, vbscript:, etc.). Note that WAF bypass is possible if the attacker uses additional URL encoding, so also inspect double-encoded payloads. Alternatively, enforce a strict Content-Security-Policy (CSP) with 'default-src self' and 'form-action self' to prevent form submissions to cross-origin targets, but this does not stop the Location header redirect itself. Monitor authentication logs for suspicious dest parameters and alert on patterns containing backslashes or unusual schemes. The patches are available in npm @saltcorn/server 1.4.6, 1.5.6, and 1.6.0-beta.5+; pull requests are visible in the GitHub advisory at https://github.com/saltcorn/saltcorn/security/advisories/GHSA-f3g8-9xv5-77gv.
More in Open Redirect
View allA malicious third-party can give a crafted "ssh://..." URL to an unsuspecting victim, and an attempt to visit the URL ca
GFI Kerio Control versions 9.2.5 through 9.4.5 contain an HTTP response splitting vulnerability in the dest parameter of
PHP through 7.0.8 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect
Multiple open redirect vulnerabilities in Apache Struts 2.0.0 through 2.3.15 allow remote attackers to redirect users to
Open redirect vulnerability in age-verification.php in the Age Verification plugin 0.4 and earlier for WordPress allows
Open redirect vulnerability in Kaseya Virtual System Administrator (VSA) 7.x before 7.0.0.29, 8.x before 8.0.0.18, 9.0 b
Vulnerability in the Oracle Applications Framework component of Oracle E-Business Suite (subcomponent: Popup windows (li
Unspecified vulnerability in the Oracle Application Server Single Sign-On component in Oracle Fusion Middleware 10.1.4.3
Flarum is open source discussion platform software. Rated medium severity (CVSS 6.5), this vulnerability is remotely exp
Open redirect vulnerability in Novius OS 5.0.1 (Elche) allows remote attackers to redirect users to arbitrary web sites
Open redirect vulnerability in the Redirect function in stageshow_redirect.php in the StageShow plugin before 5.0.9 for
Nteract v.0.28.0 was discovered to contain a remote code execution (RCE) vulnerability via the Markdown link. Rated crit
Share
External POC / Exploit Code
Leaving vuln.today