What is the CVSS score of EUVD-2025-200086?

EUVD-2025-200086 has a CVSS 3.1 base score of 6.1 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

Which versions of Open Redirect are affected by EUVD-2025-200086?

Organizations using JumpServer should be aware of moderate risk from CVE-2025-58044 rated CVSS 6.1. Exploitation could compromise the security of affected deployments.. A patch is available.

Is there a public PoC exploit available for EUVD-2025-200086?

Yes, a public proof-of-concept exploit is available for EUVD-2025-200086. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate EUVD-2025-200086?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Vendor patch is available.

Open Redirect EUVD-2025-200086

| CVE-2025-58044 MEDIUM

URL Redirection to Untrusted Site (Open Redirect) (CWE-601)

2025-12-01 security-advisories@github.com

Open Redirect Jumpserver

6.1

CVSS 3.1

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

EUVD ID Assigned

Mar 15, 2026 - 13:34 euvd

EUVD-2025-200086

Analysis Generated

Mar 15, 2026 - 13:34 vuln.today

Patch released

Mar 15, 2026 - 13:34 nvd

Patch available

CVE Published

Dec 01, 2025 - 21:15 nvd

MEDIUM 6.1

DescriptionNVD

JumpServer is an open source bastion host and an operation and maintenance security audit system. Prior to v3.10.19 and v4.10.5, The /core/i18n// endpoint uses the Referer header as the redirection target without proper validation, which could lead to an Open Redirect vulnerability. This vulnerability is fixed in v3.10.19 and v4.10.5.

Analysis

Technical ContextAI

An open redirect vulnerability allows attackers to redirect users from a trusted domain to an arbitrary external URL through manipulation of redirect parameters. This vulnerability is classified as URL Redirection to Untrusted Site (Open Redirect) (CWE-601).

RemediationAI

A vendor patch is available — apply it immediately. Validate redirect URLs against a whitelist of allowed destinations. Use relative URLs for redirects. Warn users before redirecting to external sites.

More from same product – last 7 days

CVE-2026-48856 HIGH This Week

7.1 Jun 10

Credential leakage in Erlang/OTP's inets httpc client (versions 17.0 through 29.0.2, 28.5.0.2, and 27.3.4.13) allows att

CVE-2026-11477 LOW Monitor POC

2.1 Jun 08

Open redirect in hs-web hsweb-framework's OAuth2Client component (versions up to 5.0.1) allows remote unauthenticated at

CVE-2026-21826 MEDIUM This Month

6.1 Jun 05

Host header injection in HCL Digital Experience and HCL Digital Experience Compose enables unauthenticated remote attack

CVE-2026-44889 MEDIUM This Month

6.1 Jun 04

Open redirect in WebOb (pip/webob <= 1.8.9) enables unauthenticated network attackers to redirect victims to arbitrary a

CVE-2026-41008 MEDIUM This Month

6.1 Jun 10

Spring Authorization Server's authorization endpoint fails to adequately validate the OAuth2/OIDC `request_uri` paramete

EUVD-2025-200086 vulnerability details – vuln.today

Back