Loris EUVD-2026-20978

This is a lower-severity vulnerability appropriately reflected in the CVSS 4.3 score. While the CVSS vector indicates network-accessible attack surface (AV:N), no authentication requirement (PR:N), and low complexity (AC:L), the mandatory user interaction (UI:R) significantly limits real-world exploitation impact. The vulnerability requires social engineering-tricking users into clicking a specially crafted link-rather than automated exploitation. The phishing risk is context-dependent: in open-source research institutions where LORIS users may be less security-aware, or where links are shared in institutional channels, exploitation likelihood increases. However, the limited information disclosure scope (C:L; no integrity or availability impact) and the straightforward nature of the fix suggest this ranks below critical priorities. The vulnerability does not grant attackers access to LORIS data or functionality directly; it merely misuses the application as a pivot point for external social engineering.

An attacker crafts a LORIS login URL with a malicious redirect parameter (e.g., 'https://loris.institution.edu/login?redirect=https://attacker.com/phishing') and sends it to LORIS users via email or messaging, impersonating an institutional administrator requesting credential verification. When a user clicks the link and successfully authenticates to their legitimate LORIS instance, the application automatically redirects them to the attacker's phishing page, which spoofs the LORIS login screen to capture credentials or install malware. The attack succeeds because users trust the initial LORIS domain in the URL and do not notice the redirect to an external site.