What is the CVSS score of EUVD-2026-31965?

EUVD-2026-31965 has a CVSS 3.1 base score of 5.9 (Medium). CVSS vector: CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.0%.

Is there a patch available for EUVD-2026-31965?

Yes, a patch is available for EUVD-2026-31965. Update the affected software to the latest version immediately.

Snipe-IT EUVD-2026-31965

| CVE-2026-44833 MEDIUM

URL Redirection to Untrusted Site (Open Redirect) (CWE-601)

2026-05-08 https://github.com/grokability/snipe-it

GHSA-mghp-5cq4-v6mg

Open Redirect

5.9

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

5.9 MEDIUM

AV:A/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Source Code Evidence Fetched

May 09, 2026 - 00:00 vuln.today

Analysis Generated

May 09, 2026 - 00:00 vuln.today

CVE Published

May 08, 2026 - 23:25 nvd

MEDIUM 5.9

DescriptionGitHub Advisory

Open redirect vulnerability in Snipe-IT allows attackers to redirect users to malicious sites via unvalidated HTTP Referer header stored in session variable.

Impact

Phishing: Redirect users to fake login pages to steal credentials
Session Hijacking: Redirect to attacker site that captures session cookies via JavaScript
Malware Distribution: Redirect to sites hosting malware or drive-by downloads
Reputation Damage: Users lose trust when redirected to malicious sites from legitimate application
Social Engineering: Use trusted Snipe-IT domain to increase phishing success rate

When the user clicks "Save", the application:

Processes the form
Checks redirect_option (if set to 'back')
Calls Helper::getRedirectOption()
Retrieves back_url from session: https://evil.com/phishing?target=snipeit
Executes redirect()->to($backUrl)
User is redirected to attacker's site

This would still require session poisoning, so the actual practical threat here is minimal.

Patches

Patched in https://github.com/grokability/snipe-it/commit/e37649212861a337e68a624e589c3540b7a82373, released in 8.4.1.

Workarounds

None.

Resources

CWE-601: URL Redirection to Untrusted Site ('Open Redirect')
OWASP: Unvalidated Redirects and Forwards
Laravel Security: Safe Redirects

snipeit_open_redirect_submission.md

AnalysisAI

Open redirect vulnerability in Snipe-IT versions prior to 8.4.1 allows authenticated attackers to redirect users to malicious sites by poisoning the session-stored HTTP Referer header, enabling phishing, session hijacking, and malware distribution attacks. Exploitation requires prior session poisoning and user interaction (clicking a form submission), limiting real-world practical impact despite moderate CVSS score of 5.9. Vendor-released patch available in version 8.4.1.

Technical ContextAI

Snipe-IT is a Laravel-based IT asset management application. The vulnerability exists in the redirect logic chain: when processing form submissions with redirect_option set to 'back', the application calls Helper::getRedirectOption() which retrieves an unvalidated back_url parameter from the user's session variable and passes it directly to Laravel's redirect()->to($backUrl) function without URL validation. This violates CWE-601 (URL Redirection to Untrusted Site) by failing to implement whitelist-based or domain-validation checks on redirect destinations. The root cause is trust in session-stored data without re-validation at redirect time, assuming the session layer itself provides sufficient security boundaries.

RemediationAI

Vendor-released patch: upgrade Snipe-IT to version 8.4.1 or later. The fix implements URL validation via the commit e37649212861a337e68a624e589c3540b7a82373 to sanitize redirect destinations before execution. No workarounds are documented by the vendor. As a temporary compensating control pending upgrade, administrators can disable or restrict access to form submission endpoints that trigger the redirect functionality, or implement network-level controls to monitor and block redirects to external domains by inspecting HTTP Location headers in responses. However, these controls degrade application functionality and should only be considered as temporary measures. Apply the patch at the earliest convenient maintenance window; this is not a critical patch given the exploitation prerequisites.