EUVD-2026-45998Severity by source
AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N
Network API reachable with low complexity but needs a low-privileged account (PR:L) and a victim click (UI:R); token capture enables account takeover, so C:H/I:H, no availability impact.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N
Lifecycle Timeline
2DescriptionCVE.org
dataCycle is a data management system for centrally storing, managing, searching, finding, and distributing data. In dataCycle-CORE, the module handling core processing and framework rules, before and including version 25.07.3, a low-privileged authenticated API user can supply forwardToUrl and redirectUrl values when triggering password reset or confirmation flows. Those values are then embedded into the outgoing email workflow without host allowlisting. This creates two related abuse paths:
- password reset or confirmation links can be sent to a victim with the token already attached to an attacker-controlled
forwardToUrl - after a legitimate password reset completes, the browser is redirected to attacker-controlled
redirectUrl
In practice, this can be used for phishing, token capture, confirmation hijacking, or steering a victim from a trusted email into an attacker domain. This is patched in version 26.06.08.
AnalysisAI
Open redirect and token-theft in dataCycle-CORE (all versions up to and including 25.07.3) lets a low-privileged authenticated API user inject attacker-controlled forwardToUrl and redirectUrl parameters into password-reset and confirmation email flows, which lack host allowlisting. Because a live reset/confirmation token can be appended to an attacker-controlled destination, and users are redirected off-site after completing a reset, an attacker can capture tokens, hijack confirmations, and stage convincing phishing from a trusted-domain email. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires a valid low-privileged authenticated dataCycle API account able to trigger the password-reset or confirmation flows, and the ability to supply the `forwardToUrl` and/or `redirectUrl` parameters (the exact feature named in the advisory) which are embedded into the email workflow without host allowlisting. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The vendor CVSS 3.1 score is 7.3 (AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N): network-reachable, low complexity, but requires low-privilege authentication AND victim interaction (clicking the link). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker who holds (or self-registers) a low-privileged dataCycle API account invokes the password-reset flow for a target user while setting `forwardToUrl` to an attacker-controlled domain, so the victim receives a legitimate-looking email whose reset link carries a live token pointing at the attacker's site. When the victim clicks, the token is delivered to the attacker (enabling account takeover), or after a real reset the browser is bounced to the attacker's phishing page. … |
| Remediation | Vendor-released patch: upgrade dataCycle-CORE to version 26.06.08, which adds host validation to the reset/confirmation email workflow; this is the primary and recommended fix (see advisory GHSA-8jfx-wpjg-hf38 at https://github.com/datacycle-engine/dataCycle-CORE/security/advisories/GHSA-8jfx-wpjg-hf38). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all dataCycle-CORE deployments and their versions to assess exposure. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Open Redirect
View allA malicious third-party can give a crafted "ssh://..." URL to an unsuspecting victim, and an attempt to visit the URL ca
GFI Kerio Control versions 9.2.5 through 9.4.5 contain an HTTP response splitting vulnerability in the dest parameter of
PHP through 7.0.8 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect
Multiple open redirect vulnerabilities in Apache Struts 2.0.0 through 2.3.15 allow remote attackers to redirect users to
Open redirect vulnerability in age-verification.php in the Age Verification plugin 0.4 and earlier for WordPress allows
Open redirect vulnerability in Kaseya Virtual System Administrator (VSA) 7.x before 7.0.0.29, 8.x before 8.0.0.18, 9.0 b
Vulnerability in the Oracle Applications Framework component of Oracle E-Business Suite (subcomponent: Popup windows (li
Unspecified vulnerability in the Oracle Application Server Single Sign-On component in Oracle Fusion Middleware 10.1.4.3
Flarum is open source discussion platform software. Rated medium severity (CVSS 6.5), this vulnerability is remotely exp
Open redirect vulnerability in Novius OS 5.0.1 (Elche) allows remote attackers to redirect users to arbitrary web sites
Open redirect vulnerability in the Redirect function in stageshow_redirect.php in the StageShow plugin before 5.0.9 for
Nteract v.0.28.0 was discovered to contain a remote code execution (RCE) vulnerability via the Markdown link. Rated crit
Share
External POC / Exploit Code
Leaving vuln.today