Roxy-WI EUVD-2026-36063

The victim must interact with a crafted Roxy-WI login URL containing a malicious next parameter value - confirmed by UI:R in the CVSS vector. The next parameter must use the userinfo@host bypass syntax (e.g., next=@evil.example/path), as values containing http:// or https:// are blocked by the existing filter. No authentication is required from the attacker (PR:N); the attacker only needs to deliver the crafted URL to a legitimate user. The vulnerability is not conditional on any non-default configuration - it exists in the core login redirect flow of all Roxy-WI deployments at versions 8.2.6.4 and prior. Exploitation is limited by the requirement that the victim must click the attacker-supplied link and not notice the destination URL mismatch before or after authentication.

The CVSS 6.1 Medium score reflects a network-accessible (AV:N), low-complexity (AC:L) attack requiring no privileges (PR:N) but needing user interaction (UI:R) with a Changed scope (S:C) and low confidentiality and integrity impact (C:L/I:L/A:N). The Changed scope indicates the impact extends beyond the vulnerable component itself - in this case, the victim's browser session can be hijacked to a foreign origin. Real-world risk is moderate but meaningful: this is a classic post-authentication redirect phishing vector that can harvest Roxy-WI credentials or deliver browser-based payloads against infrastructure administrators, who are high-value targets given the product manages HAProxy, Nginx, and Apache. No EPSS score was provided, no KEV listing exists, and no POC is publicly identified at time of analysis, suggesting exploitation is not yet widespread. However, the absence of a patch (confirmed by the advisory) elevates urgency because no vendor-supplied fix path exists. The low complexity and no-privilege requirement make this trivially embeddable in targeted phishing emails. The UI:R requirement is the primary exploitation limiter and is the key differentiator from a critical-rated flaw.

An attacker targeting a Roxy-WI administrator crafts a phishing email containing a login URL such as https://victim.example/login?next=@evil.example/fake-login. The administrator clicks the link, authenticates against the legitimate Roxy-WI instance, and is silently redirected to evil.example - which serves a credential-harvesting page mimicking Roxy-WI. No public exploit code has been identified at time of analysis, but the attack requires only standard HTTP request crafting and social engineering, making it accessible to low-sophistication actors.