EUVD-2026-36063Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
2DescriptionNVD
Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. In versions 8.2.6.4 and prior, the login flow allow-lists next URLs by rejecting strings containing https:// or http:// substrings, then constructs https://{request.host}{next_url} and the JS client redirects via window.location.replace(). The block does not consider the userinfo@host syntax. next=@evil.example/path produces https://victim.example@evil.example/path, which all modern browsers route to evil.example. At time of publication, there are no publicly available patches.
AnalysisAI
Open redirect in Roxy-WI versions 8.2.6.4 and prior allows unauthenticated remote attackers to silently redirect authenticated users to attacker-controlled domains by exploiting a bypass in the login flow's URL filter. The filter blocks next parameter values containing http:// or https:// substrings but does not account for RFC-3986 userinfo@host syntax; submitting next=@evil.example/path causes the server to construct https://victim.example@evil.example/path, which modern browsers route to evil.example. No public exploit code has been identified at time of analysis, no patch is available, and this vulnerability is not listed in CISA KEV.
Technical ContextAI
Roxy-WI (CPE: cpe:2.3:a:roxy-wi:roxy-wi:*:*:*:*:*:*:*:*) is a web management interface for infrastructure-layer services including HAProxy, Nginx, Apache, and Keepalived. The vulnerability is rooted in CWE-601 (URL Redirection to Untrusted Site / Open Redirect), a class of flaw where applications trust user-supplied URL fragments without fully validating the target authority. The specific bypass exploits RFC-3986 URI syntax, which allows a userinfo component before the host - i.e., scheme://userinfo@host/path. The application's server-side filter only scans for the literal substrings http:// and https://, which a value like @evil.example/path does not contain. When the server concatenates this value as https://{request.host}{next_url}, it produces a syntactically valid URL where the intended host (victim.example) is silently demoted to the userinfo field and the attacker's domain (evil.example) becomes the actual host authority. The JavaScript client then executes window.location.replace() with the attacker-crafted URL, completing the redirect transparently.
RemediationAI
No vendor-released patch has been identified at time of analysis - the advisory explicitly states no publicly available patches exist as of publication. Organizations should monitor the GitHub advisory at https://github.com/roxy-wi/roxy-wi/security/advisories/GHSA-xw9x-68gg-mp5h for patch availability. As immediate compensating controls: first, restrict access to the Roxy-WI login endpoint to trusted IP ranges or VPN-only access, which eliminates the network-reachable attack surface at the cost of reduced accessibility for remote administrators. Second, deploy a reverse proxy or WAF rule that rejects next parameter values containing the @ character, blocking the userinfo@host bypass pattern without affecting legitimate redirect values; note this is a defense-in-depth measure and may need tuning if @ appears in legitimate paths. Third, train administrators to scrutinize Roxy-WI login links in emails and messages, as this attack requires social engineering. Upgrading the application when a patched version is released remains the only definitive fix.
More in Open Redirect
View allA malicious third-party can give a crafted "ssh://..." URL to an unsuspecting victim, and an attempt to visit the URL ca
GFI Kerio Control versions 9.2.5 through 9.4.5 contain an HTTP response splitting vulnerability in the dest parameter of
PHP through 7.0.8 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect
Multiple open redirect vulnerabilities in Apache Struts 2.0.0 through 2.3.15 allow remote attackers to redirect users to
Open redirect vulnerability in age-verification.php in the Age Verification plugin 0.4 and earlier for WordPress allows
Open redirect vulnerability in Kaseya Virtual System Administrator (VSA) 7.x before 7.0.0.29, 8.x before 8.0.0.18, 9.0 b
Vulnerability in the Oracle Applications Framework component of Oracle E-Business Suite (subcomponent: Popup windows (li
Unspecified vulnerability in the Oracle Application Server Single Sign-On component in Oracle Fusion Middleware 10.1.4.3
Flarum is open source discussion platform software. Rated medium severity (CVSS 6.5), this vulnerability is remotely exp
Open redirect vulnerability in Novius OS 5.0.1 (Elche) allows remote attackers to redirect users to arbitrary web sites
Open redirect vulnerability in the Redirect function in stageshow_redirect.php in the StageShow plugin before 5.0.9 for
Nteract v.0.28.0 was discovered to contain a remote code execution (RCE) vulnerability via the Markdown link. Rated crit
Share
External POC / Exploit Code
Leaving vuln.today