Nforwardauth
Monthly
Post-authentication open redirect in nforwardauth through 1.5.0 lets an unauthenticated attacker craft a legitimate-looking /login?r= URL that sends a victim to an attacker-controlled site after a successful login. The vendor advisory, pull request #71 and the v1.5.1 release confirm both the flaw and its fix, and the advisory includes a public proof-of-concept that reproduces the server-side 307 Location redirect. Exploitation requires the victim to follow the crafted link and complete authentication (UI:R), so the impact is limited to phishing and social-engineering leverage on a trusted authentication domain; the vendor explicitly states this is not a ForwardAuth authentication bypass. No public exploit code beyond that advisory PoC and no active exploitation are indicated in the available data.
Post-authentication open redirect in nforwardauth through 1.5.0 lets an unauthenticated attacker craft a legitimate-looking /login?r= URL that sends a victim to an attacker-controlled site after a successful login. The vendor advisory, pull request #71 and the v1.5.1 release confirm both the flaw and its fix, and the advisory includes a public proof-of-concept that reproduces the server-side 307 Location redirect. Exploitation requires the victim to follow the crafted link and complete authentication (UI:R), so the impact is limited to phishing and social-engineering leverage on a trusted authentication domain; the vendor explicitly states this is not a ForwardAuth authentication bypass. No public exploit code beyond that advisory PoC and no active exploitation are indicated in the available data.