Scoold CVE-2026-55840

Exploitation requires the attacker to craft a sign-in URL whose backto or returnto parameter is an absolute URL whose hostname begins with the configured server hostname (e.g. example.com.evil.com), defeating the pre-1.69.1 Strings.CI.startsWith check in HttpUtils.getBackToUrl(). The critical LIMITING factor is user interaction: a victim must actively follow the crafted authentication link and complete sign-in for the redirect to fire (UI:R). No attacker authentication is needed (PR:N), and default configurations are affected, but impact is confined to post-authentication redirection to an attacker domain, so success also depends on the victim then disclosing credentials/tokens at the malicious site. Affected: all Scoold versions prior to 1.69.1.

This is a genuine but moderate-severity open redirect (CWE-601), not a top-tier priority. The CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N, score 5.4) is internally consistent with the description: network-reachable, low complexity, no authentication, but critically requiring user interaction (UI:R) because a victim must click the crafted sign-in link. Confidentiality and integrity impacts are LOW (C:L/I:L) - limited to credential/token exposure via post-authentication redirect - with no availability impact. No EPSS score was provided, so exploitation probability cannot be quantified. The CVE is NOT in CISA KEV and no public POC is referenced, meaning no public exploit identified at time of analysis. The real limiting factor is the mandatory phishing-style social-engineering step plus the fact that Scoold has a small deployment footprint, so mass exploitation is unlikely. The flaw and fix are strongly corroborated by the vendor commit diff, which replaces the weak Strings.CI.startsWith prefix check with a strict same-origin comparison (host, scheme, and port, plus userinfo rejection). No conflicting signals are present; the main gap is absent EPSS/exploitation-probability data.

An attacker crafts a Scoold sign-in link whose backto/returnto parameter points to an absolute URL like https://example.com.evil.com/steal, where the hostname begins with the legitimate server hostname so the flawed startsWith prefix check passes. The attacker sends this link to a victim via phishing; after the victim authenticates, Scoold redirects them to the attacker-controlled domain, where credentials or OAuth/session tokens can be harvested. No public exploit code is identified, though the mechanism is simple and the fixing commit documents the exact bypass.