Leantime CVE-2026-66414

The vulnerability is triggered when an authenticated user follows an attacker-crafted Leantime login URL whose redirectUrl POST parameter contains an external or protocol-relative URL. The Leantime login form already submits redirectUrl as a hidden POST field by default, so no non-default configuration is required - a standard Leantime 3.6.2 installation with a web-accessible login page is sufficient. The bypass is possible because FILTER_SANITIZE_URL is not an origin-validation function: protocol-relative URLs (//attacker.com), backslash-normalized variants (//attacker.com), and well-formed external absolute URLs all pass through unblocked. Exploitation is limited by: (1) mandatory user interaction - the victim must click the crafted link AND successfully authenticate; (2) impact is confined to post-login redirect destination and does not yield server-side execution or direct data access; (3) the victim must hold valid Leantime credentials. No special server configuration, elevated role, or non-default feature flag is required beyond a default deployment.

The CVSS 4.0 score of 5.1 (Medium) accurately reflects the bounded impact profile: network-accessible (AV:N), low complexity (AC:L), no attacker privileges required (PR:N), but mandatory active user interaction (UI:A - the victim must both receive the crafted link and successfully authenticate). Impact is limited to partial confidentiality and integrity (VC:L/VI:L) - no server-side code execution, data exfiltration from the application database, or availability impact. The SC:L/SI:L metrics acknowledge downstream risk on the subsequent system (the attacker's phishing site harvesting credentials). No EPSS data was provided in the input, so exploitation probability cannot be quantified numerically. The absence from CISA KEV indicates no confirmed broad active exploitation at time of analysis, but the existence of public POC code (VulnCheck, GHSA-wprg-q8m6-jhp9) meaningfully lowers the barrier to exploitation. The real-world risk is higher than the score alone suggests for organizations where Leantime is internet-facing: open redirects from trusted project management domains carry elevated phishing credibility. The CVSS vector and description are fully consistent - no conflicting signals detected.

A publicly available POC exists per VulnCheck and GHSA-wprg-q8m6-jhp9. An attacker crafts a Leantime login URL with a redirectUrl POST parameter value set to an external phishing domain (e.g., //evil-attacker.com/fake-leantime) - bypassing FILTER_SANITIZE_URL - and delivers it to a target Leantime user via a spear-phishing email; the victim authenticates normally and is silently redirected to the attacker's site, which mimics the Leantime interface to harvest credentials or deliver further payloads under the guise of a legitimate post-login session.