EUVD-2026-20978Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Primary rating from GitHub Advisory · only source for this CVE.
CVSS VectorGitHub Advisory
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Lifecycle Timeline
4DescriptionGitHub Advisory
LORIS (Longitudinal Online Research and Imaging System) is a self-hosted web application that provides data- and project-management for neuroimaging research. Prior to 27.0.3 and 28.0.1, the redirect parameter upon login to LORIS was not validating the value of the redirect as being within LORIS, which could be used to trick users into visiting arbitrary URLs if they are given a link with a third party redirect parameter. This vulnerability is fixed in 27.0.3 and 28.0.1.
AnalysisAI
Open redirect vulnerability in LORIS (Longitudinal Online Research and Imaging System) versions prior to 27.0.3 and 28.0.1 allows unauthenticated remote attackers to redirect authenticated users to arbitrary external websites via a malicious redirect parameter during login. The vulnerability requires user interaction (clicking a crafted link) but poses a meaningful phishing risk in neuroimaging research environments where LORIS deployments are common. No public exploit code or active exploitation has been confirmed at the time of analysis.
Technical ContextAI
LORIS is a self-hosted web application framework for managing longitudinal neuroimaging research data and projects. The vulnerability stems from insufficient input validation on the redirect parameter processed during the login workflow (CWE-601: URL Redirection to Untrusted Site). Upon successful authentication, the application fails to verify that the redirect destination is within the LORIS application domain before performing an HTTP redirect, enabling attackers to craft malicious login URLs that appear legitimate but redirect to external phishing sites, credential harvesting pages, or other attacker-controlled infrastructure after the user completes authentication.
RemediationAI
Vendor-released patch: Upgrade to LORIS 27.0.3 or 28.0.1 or later. The fix validates that redirect parameters point to URLs within the LORIS application domain before performing the redirect. Organizations unable to upgrade immediately should implement a Web Application Firewall (WAF) rule to block login requests containing suspicious redirect parameters pointing to external domains, or administratively restrict user access to known-safe LORIS login URLs. Detailed remediation guidance is available in the GitHub security advisory at https://github.com/aces/Loris/security/advisories/GHSA-rch2-f5fw-cg95 and from the patch commit at https://github.com/aces/Loris/commit/f57f54b42a076bf53ba86e20d4dbf37f63538f58.
More in Open Redirect
View allA malicious third-party can give a crafted "ssh://..." URL to an unsuspecting victim, and an attempt to visit the URL ca
GFI Kerio Control versions 9.2.5 through 9.4.5 contain an HTTP response splitting vulnerability in the dest parameter of
PHP through 7.0.8 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect
Multiple open redirect vulnerabilities in Apache Struts 2.0.0 through 2.3.15 allow remote attackers to redirect users to
Open redirect vulnerability in age-verification.php in the Age Verification plugin 0.4 and earlier for WordPress allows
Open redirect vulnerability in Kaseya Virtual System Administrator (VSA) 7.x before 7.0.0.29, 8.x before 8.0.0.18, 9.0 b
Vulnerability in the Oracle Applications Framework component of Oracle E-Business Suite (subcomponent: Popup windows (li
Unspecified vulnerability in the Oracle Application Server Single Sign-On component in Oracle Fusion Middleware 10.1.4.3
Flarum is open source discussion platform software. Rated medium severity (CVSS 6.5), this vulnerability is remotely exp
Open redirect vulnerability in Novius OS 5.0.1 (Elche) allows remote attackers to redirect users to arbitrary web sites
Open redirect vulnerability in the Redirect function in stageshow_redirect.php in the StageShow plugin before 5.0.9 for
Nteract v.0.28.0 was discovered to contain a remote code execution (RCE) vulnerability via the Markdown link. Rated crit
Share
External POC / Exploit Code
Leaving vuln.today