EUVD-2026-43083
GHSA-vwxh-w8pq-6q99
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Open redirect requires victim interaction for phishing impact; low complexity and no authentication needed; partial confidentiality and integrity impact via spoofing, no availability impact.
Primary rating from Vendor (drupal).
CVSS VectorVendor: drupal
Lifecycle Timeline
5DescriptionCVE.org
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Drupal Drupal core allows Content Spoofing. This issue affects Drupal core versions: from 0.0.0 to 10.5.12, from 10.6.0 to 10.6.11, from 11.2.0 to 11.2.14, from 11.3.0 to 11.3.12, from 0.0.0 to 11.0.*, from 0.0.0 to 11.1.*.
AnalysisAI
Open redirect in Drupal Core across multiple major release branches enables phishing and content spoofing attacks by forwarding victims from a trusted Drupal domain to an attacker-controlled site via crafted URLs. The exposure spans the 10.x and 11.x release trains, creating a broad attack surface across the Drupal install base. EPSS probability sits at 0.13% (3rd percentile) and the vulnerability is absent from CISA KEV, indicating low observed exploitation to date despite the wide version coverage.
Technical ContextAI
Drupal Core (cpe:2.3:a:drupal:drupal_core) implements URL routing and redirect handling within its request processing pipeline. CWE-601 (URL Redirection to Untrusted Site) arises when user-supplied destination parameters in redirect responses are not validated against a trusted-domain allowlist before the HTTP redirect is issued. An attacker can embed an externally controlled URL in a redirect parameter served by a Drupal endpoint - the victim's browser then follows the redirect from the legitimate Drupal origin to the malicious destination. The 'Content Spoofing' tag confirms the primary abuse case: presenting fraudulent content or credential-harvesting pages under the credibility of a trusted Drupal domain. This class of flaw requires no exploitation of memory corruption or complex protocol interaction; standard HTTP request handling is the only mechanism involved.
RemediationAI
Apply the vendor-released patch documented in Drupal Security Advisory SA-CORE-2026-007 at https://www.drupal.org/sa-core-2026-007. Based on the affected version boundaries, expected fixed releases are 10.5.13 or later in the 10.5.x train, 10.6.12 or later in 10.6.x, 11.2.15 or later in 11.2.x, and 11.3.13 or later in 11.3.x - however, these fix versions are inferred from CVE boundary data and must be confirmed against the advisory before acting. Sites on 11.0.x or 11.1.x should migrate to a supported branch (11.2.x or 11.3.x) as no backport is indicated for those lines. If patching cannot be applied immediately, a WAF rule blocking or warning on external-domain redirect targets in Drupal URL parameters provides a compensating control, though this may disrupt legitimate cross-domain redirect flows and must be tested against site functionality. Enforcing a server-side allowlist of permitted redirect destinations within the application layer is a lower-disruption alternative.
More in Open Redirect
View allA malicious third-party can give a crafted "ssh://..." URL to an unsuspecting victim, and an attempt to visit the URL ca
GFI Kerio Control versions 9.2.5 through 9.4.5 contain an HTTP response splitting vulnerability in the dest parameter of
PHP through 7.0.8 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect
Multiple open redirect vulnerabilities in Apache Struts 2.0.0 through 2.3.15 allow remote attackers to redirect users to
Open redirect vulnerability in age-verification.php in the Age Verification plugin 0.4 and earlier for WordPress allows
Open redirect vulnerability in Kaseya Virtual System Administrator (VSA) 7.x before 7.0.0.29, 8.x before 8.0.0.18, 9.0 b
Vulnerability in the Oracle Applications Framework component of Oracle E-Business Suite (subcomponent: Popup windows (li
Unspecified vulnerability in the Oracle Application Server Single Sign-On component in Oracle Fusion Middleware 10.1.4.3
Flarum is open source discussion platform software. Rated medium severity (CVSS 6.5), this vulnerability is remotely exp
Open redirect vulnerability in Novius OS 5.0.1 (Elche) allows remote attackers to redirect users to arbitrary web sites
Open redirect vulnerability in the Redirect function in stageshow_redirect.php in the StageShow plugin before 5.0.9 for
Nteract v.0.28.0 was discovered to contain a remote code execution (RCE) vulnerability via the Markdown link. Rated crit
Share
External POC / Exploit Code
Leaving vuln.today