CTFd EUVD-2026-64670

The attacker must be able to deliver a crafted CTFd login URL to a target user - typical delivery vectors include competition Discord servers, email invitations, or public event announcements. The victim must actively click the attacker-supplied URL and complete the CTFd login flow, at which point the bypass redirect fires. No authentication by the attacker is required (PR:N in CVSS 4.0). No non-default configuration is necessary: any CTFd instance with a publicly accessible login page running an affected version is exposed. Exploitation is bounded by the victim-interaction requirement (UI:P): the victim must click the link. This prevents fully automated or unaided exploitation. The attack surface is widened by the open-registration nature of public CTF events, where distributing malicious links to a large pool of participants is straightforward.

The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P) characterizes this as low-complexity, network-accessible, requiring no attacker privileges, but dependent on passive user interaction (victim must click a crafted link). No confidentiality or availability impact is modeled; only a limited integrity effect on the vulnerable system is scored. The exploit-maturity tag E:P confirms a public PoC is available, elevating realistic exploitation probability beyond the base score. No EPSS probability score is present in available data so quantitative exploitation likelihood cannot be stated. No CISA KEV listing exists, meaning confirmed active exploitation is not established. The practical threat is phishing: CTFd deployments that accept public registrations or have public-facing login pages are directly exposed - no special configuration is required. However, the CHANGELOG's mention of a potential JavaScript execution path suggests the effective severity could be higher than a pure open-redirect CVSS score implies, particularly if the XSS-adjacent issue shares this code path. Overall this is a moderate priority for operators of public-facing CTF competitions, elevated from routine open-redirect status by the public PoC and potential JS execution risk.

An attacker crafts a CTFd login URL with a bypass value in the 'Next' parameter (e.g., appending '?next=//attacker.com' or an equivalent double-slash or protocol-relative variant that evades the _is_safe_url check) and distributes it to competition participants via Discord, email, or CTF announcement channels. The victim clicks the link, completes authentication against the legitimate CTFd instance, and is silently redirected to an attacker-controlled phishing page that mimics the competition interface to harvest credentials or session tokens. A public writeup detailing the bypass technique is available at https://mblunt.dev/writeups/ctfd-open-redirect/.