Cotonti CMS EUVD-2026-87378

Exploitation targets any Cotonti installation through version 1.0.0 in its default configuration - no authentication or special feature toggle is required, since message.php accepts and base64-decodes the redirect parameter unconditionally. The single limiting factor is required victim interaction (UI:A): the target must open the attacker-crafted message.php link for the meta-refresh redirect to fire. There is no impact to the Cotonti server itself; the payoff depends on the victim being deceived on the destination phishing page, so effectiveness rests on social engineering rather than any technical prerequisite.

This is a classic open-redirect (CWE-601) in the Cotonti CMS message.php handler, which base64-decodes the redirect parameter and emits it in a meta-refresh tag with no domain validation. The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N, 5.1 Medium) is internally consistent with an open redirect: network-reachable and unauthenticated (PR:N), but requiring victim interaction (UI:A) and producing no impact on the vulnerable system itself - the only impact is low confidentiality/integrity on a subsequent system (the victim, who is steered to an attacker-controlled page). No EPSS score, KEV listing, or public exploit code is present in the supplied data, so there is no public exploit identified at time of analysis and no evidence of active exploitation. Real-world risk is modest and bounded: open redirects are not directly server-compromising and are primarily useful as a phishing/credibility-laundering primitive that abuses the trusted Cotonti domain. This is a genuine-but-low-priority issue - its value to an attacker is entirely in social-engineering leverage, not in technical compromise. A vendor patch (PR #1908) is confirmed available, which adds cot_url_check() / relative-path validation before honoring the redirect.

An attacker base64-encodes a malicious external URL and embeds it in the redirect parameter of a Cotonti message.php link, then distributes that link (which shows the trusted Cotonti site's domain) via email or chat. When a victim clicks and the message page loads, the meta-refresh tag silently forwards them to the attacker's phishing site. No public exploit code is referenced, but the technique is trivial to reproduce from the described flaw.