EUVD-2026-110037Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V3 - Web Frontend Security Redirect URL validation
MITRE ATT&CK
1 technique across 1 tactic: Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Impact | This is a post-authentication open redirect (CWE-601) in nforwardauth, scored CVSS 6.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) by the vendor advisory. The signals are internally consistent and point to a genuine but bounded issue rather than a critical priority: the attack vector is network and complexity is low, but UI:R is the dominant limiter - the victim must click an attacker-crafted link AND successfully authenticate before the redirect fires. The vuln.today priority is 'this_month' (not act_now/emergency). No EPSS score was provided in the input and the CVE is not listed in CISA KEV, so there is no evidence of active exploitation; this is 'no public exploit identified' in the KEV sense, though the GHSA advisory itself contains detailed reproduction steps (see exploit_scenario). The advisory, PR, and commit explicitly confirm this does NOT grant a ForwardAuth bypass, session-cookie disclosure, or code execution - the real-world impact is confined to phishing/social-engineering that abuses trust in the legitimate auth domain. Net: a legitimate medium-severity issue worth patching on a normal cycle, not a high-CVSS-but-illusory finding and not an emergency. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 26, 2026
Post-authentication open redirect in nforwardauth through 1.5.0 lets an unauthenticated attacker craft a legitimate-looking /login?r= URL that sends a victim to an attacker-controlled site after a successful login. The vendor advisory, pull request #71 and the v1.5.1 release confirm both the flaw and its fix, and the advisory includes a public proof-of-concept that reproduces the server-side 307 Location redirect. Exploitation requires the victim to follow the crafted link and complete authentication (UI:R), so the impact is limited to phishing and social-engineering leverage on a trusted authentication domain; the vendor explicitly states this is not a ForwardAuth authentication bypass. No public exploit code beyond that advisory PoC and no active exploitation are indicated in the available data.
RemediationAI
Upgrade to nforwardauth 1.5.1 (release tag https://github.com/nosduco/nforwardauth/releases/tag/v1.5.1, fix introduced in PR https://github.com/nosduco/nforwardauth/pull/71 and commit 664f2602f9e1459558d1c4c55019f6d48bc64c43), which validates the r parameter server-side and rejects foreign destinations, logging "Warning: Rejected foreign post-login redirect target" and serving the logout page instead. Because the fixed logic only permits http/https destinations whose host matches the configured cookie_domain or a subdomain of it, deployments that legitimately redirect users to a different hostname must set COOKIE_DOMAIN to the common parent domain before upgrading; otherwise post-login redirects will be dropped, and note that bare relative paths (for example /some/path) are also rejected by the new validator and fall through to the logout page. If upgrading immediately is not possible, reduce exposure by not distributing /login links containing an r parameter, alerting users that post-login redirects to external domains are unexpected, and filtering inbound links whose r value is an absolute URL pointing outside your own domain at the reverse proxy or mail gateway, accepting that such filtering must handle encoding, backslash and parser-difference bypasses and is not a complete substitute for the patched release.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
nforwardauth is a forward-auth middleware that centralises authentication for multiple sites behind a reverse proxy. The /login endpoint accepts an r query parameter intended as the post-authentication destination, and version 1.5.0 used the raw value in two places without validating that the destination was trusted: the Rust handler in src/main.rs (api_login_wrapper) echoed it directly into the Location response header, producing a 307 Temporary Redirect to any absolute URL, and assets/js/script.js called window.location.replace(params.r) in the browser after login. This is CWE-601 (URL Redirection to Untrusted Site), a redirect-validation defect rather than a memory-safety or logic flaw in the authentication check itself. The v1.5.1 patch adds host_matches_domain() and validate_redirect_target(), which accept only http/https URLs whose host equals the configured cookie_domain or a subdomain of it (dot-boundary matching blocks suffix lookalikes such as evilyourdomain.com), and reject javascript:, data:, ftp:, scheme-relative //host and bare relative paths; the client-side path now re-issues a GET of the current page so the server performs the validation. Unit tests in the patch cover the reported payload, subdomain acceptance, lookalike-domain rejection, non-HTTP schemes and scheme-relative values.
Know when Nforwardauth gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Primary rating from Vendor (GitHub_M) · only source for this CVE.
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
1DescriptionCVE.org
nforwardauth is a forward auth service that allows the use of a single authentication middleware for multiple sites. Versions prior to 1.5.1 accept an unvalidated r query parameter on the /login endpoint and use them as the post-authentication redirect destination. An unauthenticated attacker can create a legitimate nforwardauth login URL that redirects a victim to an attacker-controlled website after the victim successfully authenticates. This issue may facilitate phishing and other social-engineering attacks by abusing the trust associated with the legitimate authentication domain. This vulnerability does not provide an unauthenticated ForwardAuth bypass. Version 1.5.1 contains a patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
GitHub
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
Exploit-DB