Open Redirect

NSP is vulnerable to an open redirect due to insufficient server-side validation of the URL (or redirect) parameter.

Open redirect in Rodauth before 2.47.0 enables post-authentication phishing by failing to reject protocol-relative return-to paths beginning with double slashes. The three affected features - confirm_password, login_return_to_requested_location, and two_factor_auth_return_to_requested_location - stored the raw request path into session without validating that it could not resolve as an external URL. No public exploit or active exploitation has been confirmed at time of analysis, and a patch is available in version 2.47.0.

Open redirect in pac4j-core before 6.5.6 allows network-accessible attackers to redirect authenticated users to attacker-controlled sites immediately after logout. DefaultLogoutLogic.perform() validated logout redirect targets against a URL pattern regex, but that regex did not exclude backslash characters; browsers normalize backslash-prefixed paths (e.g., \evil.com) into network-path references (//evil.com), bypassing the intended allow-list. No public exploit code has been identified and the vulnerability is not listed in CISA KEV, but the low attack complexity makes exploitation straightforward once a crafted logout link reaches a victim.

Open redirect in MasterStudy LMS WordPress Plugin before version 3.7.43 enables unauthenticated attackers to supply an unvalidated redirect parameter during user registration, silently forwarding newly registered users to arbitrary external URLs. This creates a reliable phishing vector: an attacker crafts a registration link pointing to a spoofed login page, and the plugin delivers the victim there immediately post-registration without warning. A publicly available proof-of-concept exists per WPScan, though the EPSS score of 0.14% (3rd percentile) indicates exploitation has not yet become widespread or automated.

Open redirect in Pocket ID's OIDC /authorize page (versions 2.6.0-2.8.0) allows an unauthenticated network attacker to redirect any victim browser to an arbitrary external HTTPS URL by supplying a crafted authorization link with prompt=none and an unregistered redirect_uri. The SvelteKit frontend's onMount() handler issues window.location.href from the raw redirect_uri before the backend's allow-list validator is ever invoked, completely bypassing the per-client callback URL enforcement that protects the standard interactive flow. A public PoC is confirmed at code level (commit fc42f62) and the fix is released in v2.9.0; no active exploitation (CISA KEV) has been reported.

OAuth authorization code forwarding to attacker-controlled hosts is enabled by an open redirect flaw in Twenty CRM through version 2.35.0, where the OAuthPropagatorController.propagateOAuthCallback endpoint accepts the state query parameter as an unvalidated redirect URL. Instances running with IS_MULTIWORKSPACE_ENABLED disabled are specifically vulnerable because this configuration bypasses the domain validation logic that would otherwise restrict redirect targets. No active exploitation has been confirmed in the CISA KEV catalog and no public proof-of-concept code was identified in the provided data, but the attack requires only a crafted link and passive victim interaction.

Open redirect in Spring Authorization Server 1.5.0-1.5.7 allows remote unauthenticated attackers to redirect victims to attacker-controlled sites by crafting authorization requests that pair an invalid request_uri with an unvalidated redirect_uri. The CVSS scope change (S:C) reflects that the redirect escapes the authorization server's security boundary, enabling high-trust phishing attacks because victims see the legitimate authorization server domain before being redirected. No public exploit has been identified at time of analysis, and exploitation requires user interaction.

Open redirect in Spring Framework's UrlFileNameViewController exposes users of affected Spring MVC applications to phishing and credential-harvesting attacks across all active Spring Framework release trains (5.2.x through 7.0.x). The flaw allows an unauthenticated attacker to craft a URL that causes the vulnerable application to redirect victims to an arbitrary external domain, exploiting the controller's path-to-view-name resolution when end-of-path mapping is used without a configured prefix. No active exploitation has been confirmed - EPSS sits at 0.14% (4th percentile) and CISA SSVC reports exploitation status as none, making this a targeted patching priority rather than an emergency.

Open redirect in Spring Framework's UrlHandlerFilter allows unauthenticated remote attackers to silently redirect authenticated users to attacker-controlled URLs. Affected are Spring Framework 7.0.0-7.0.8 and 6.2.0-6.2.19 in both Spring MVC and Spring WebFlux deployments where UrlHandlerFilter is configured with broadly matching URL patterns. No public exploit code exists and SSVC indicates no known active exploitation; however, the no-privilege, network-reachable attack vector makes this a credible phishing enabler in affected applications. EPSS sits at 0.15% (5th percentile), consistent with low-automated-exploitation likelihood.

OAuth authorization code hijacking in Stalwart Mail Server through v0.16.19 enables full email account takeover when a victim authenticates via a crafted phishing link. The validation routine for OAuth redirect URIs in the default shipped configuration - where client authentication is disabled - returns success immediately without comparing the supplied redirect_uri against any registered client destination, allowing any attacker-controlled URI to receive a valid authorization code. The CVSS 4.0 score of 8.5 with high confidentiality and integrity impact reflects the severity of resulting mailbox compromise; no public exploit code has been identified at time of analysis, though the vulnerability is fully described in a public GitHub issue with source-level detail.

JWT token disclosure in OpenMetadata's SAML and OIDC/OAuth2 authentication flows enables account takeover by exploiting an unvalidated open redirect that appends the victim's freshly issued JWT, email, and account name to an attacker-controlled URL. All 1.x releases are affected because neither SamlLoginServlet nor the OIDC/OAuth2 handler validates the caller-supplied redirect destination against any allowlist or registered callback set. An attacker who socially engineers a victim into clicking a crafted login URL can capture the full JWT upon successful authentication and immediately assume control of that account via the OpenMetadata API. No public exploit has been identified at time of analysis, and no CISA KEV listing is confirmed.

Open redirect in Kimai's SAML Assertion Consumer Service handler (versions up to and including 2.52.0) enables an attacker with IdP-level access to redirect successfully authenticated users to arbitrary attacker-controlled URLs by supplying a malicious RelayState POST parameter. The vulnerable code in SamlAuthenticationSuccessHandler.php performs no host or scheme validation on the RelayState value - only checking that it does not equal the configured login_path - meaning any fully qualified external URL is accepted as a redirect destination post-SSO. Exploitation is narrowly constrained: SAML must be explicitly enabled (a non-default configuration) and the attacker must control or compromise the IdP; no public exploit has been identified at time of analysis, and this CVE is not listed in the CISA KEV catalog.

Unauthenticated OAuth redirect URI hijacking in Coroot versions 1.20.2 through 1.24.5 allows attackers to register malicious MCP OAuth clients without any credentials, then capture authorization codes from signed-in users who follow crafted authorization URLs and approve a consent dialog. The captured codes can be exchanged for valid access tokens, enabling full MCP session hijacking. No public exploit has been identified at time of analysis and no CISA KEV listing is present, but the registration step requires no authentication, materially lowering attacker prerequisites.

OAuth redirect URI validation in Ech0 through 4.5.6 allows session hijacking via exchange-code theft by exploiting incomplete allowlist enforcement. The `parseAndValidateClientRedirect` function at `internal/service/auth/auth.go:448` compares only scheme and host of the client-supplied `redirect_uri` against the admin allowlist, ignoring path, query, and fragment in violation of RFC 6749 §3.1.2. An attacker who induces a victim to follow a crafted OAuth login link can redirect the post-authentication browser to any path on an allowlisted host, exposing the one-time exchange code via Referer headers or analytics, then redeem it at `POST /api/auth/exchange` for the victim's access and refresh tokens. No public exploit or CISA KEV listing is confirmed at time of analysis; a detailed public advisory (GHSA-p64j-f4x9-wq66) with source code evidence lowers the bar for independent exploitation. Fixed in 4.7.3.

Adminer 4.6.0 through 5.4.x blindly prepends the client-supplied X-Forwarded-Prefix HTTP header to internally constructed URLs with no trusted-proxy allowlist or value sanitization, allowing attacker-controlled URL prefixes to propagate into Location redirect headers, Set-Cookie path attributes, and self-referential links. This yields an authenticated open redirect on state-changing POSTs and unauthenticated control of session cookie path scoping against default deployments in the affected version range. CR/LF injection is blocked, ruling out header splitting and XSS despite the intelligence source's XSS tag - that tag appears to be a mis-classification and should not inflate risk estimates. No public exploit has been identified at time of analysis, and no CISA KEV listing exists.

Open redirect via safe-URL validator bypass in CTFd versions 3.8.0 through 3.8.3 allows remote unauthenticated attackers to craft login URLs that redirect victims to attacker-controlled sites, enabling phishing of competition participants. The vulnerability lies in the _is_safe_url() function within CTFd/utils/validators/__init__.py, which fails to correctly reject malformed or protocol-relative values supplied via the 'Next' query parameter. The vendor CHANGELOG for the patched release (3.8.4) further notes that attacker-controlled links could serve as a vector for arbitrary JavaScript execution if clicked, suggesting the integrity impact may exceed the open-redirect framing; a public exploit writeup exists and no active KEV listing is present at time of analysis.

Open redirect in the J2Store Joomla e-commerce extension (versions 1.0.0-3.3.20, 4.0.0-4.0.20, and 4.1.0-4.1.5) enables unauthenticated remote attackers to craft phishing URLs that abuse the trusted domain of a legitimate shop. Four cart controller task handlers decode a base64-encoded URL from user-supplied input and redirect without validating the destination hostname, allowing attackers to route victims to arbitrary external sites while the URL appears to originate from the merchant's real domain. No public exploit has been identified at time of analysis and the vulnerability is absent from CISA KEV, but the unauthenticated network access path and low attack complexity make this straightforward to leverage in targeted phishing campaigns against shop customers.

Reflected XSS and open redirect in yootheme.com's Zoo extension for Joomla (versions prior to 4.1.66) allow remote attackers to inject arbitrary JavaScript into a victim's browser session or redirect users to attacker-controlled URLs by crafting a malicious link containing an unsanitized submission redirect parameter. Exploitation requires a user to follow the crafted link, limiting automated mass exploitation. No public exploit code or active exploitation in CISA KEV has been identified at time of analysis.

Cross-origin redirect bypass in SecureDrop Client prior to 1.3.1 allows a malicious SecureDrop Server to route the securedrop-proxy component's HTTP requests to arbitrary external origins, circumventing the proxy's intended origin restriction. The Rust-based proxy followed HTTP 3xx redirects without validation, so a server-side redirect response could silently exfiltrate request data to a cross-origin destination. No public exploit code exists and the fix - disabling redirect following entirely via reqwest's RedirectPolicy::none() - is confirmed in version 1.3.1.

Server-side request forgery in the Unstructured-IO `unstructured` library (0.4.7 through versions before 0.24.0) lets an attacker who controls the `url=` argument of partition(), partition_html(), or partition_md() coerce a server-side ingestion service into fetching loopback, internal, or cloud-metadata endpoints, with the response returned as Element text. Because ingestion pipelines commonly accept user-supplied URLs, unauthenticated remote abuse is realistic (CVSS 9.3). No public exploit identified at time of analysis; the flaw is fixed in 0.24.0 via a centralized fetch helper.

Open redirect bypass in WebOb prior to 1.8.11 enables network-accessible, unauthenticated attackers to redirect users to attacker-controlled hosts by exploiting a URL normalization gap between WebOb's validation checks and Python's urllib.parse.urljoin. The flaw exists in Response._make_location_absolute(), Request.relative_url(), and _HTTPMove subclasses including HTTPFound - a space-prefixed protocol-relative or absolute URL passes SCHEME_RE and startswith('//') guards unchanged, then urllib.parse.urljoin silently strips the leading space on Python 3.10+, resolving the remainder as a valid off-host URL. No public exploit is identified at time of analysis; vendor patch is confirmed in version 1.8.11 and the attack surface is phishing and OAuth/SSO token theft requiring the victim to follow the redirect.

Open redirect in Punk::OAuth2 before 0.03 for Perl allows an attacker to redirect authenticated users to an arbitrary external domain by exploiting a gap in the same_origin_path validation function. The return parameter in the OAuth2 login flow accepts backslash and tab characters that the WHATWG URL parser interprets as path/authority delimiters, enabling values like /\evil.example or tab-separated //evil.example to survive the check and become the post-login redirect target. No authorization code or access token is carried in the redirect, so the immediate impact is post-authentication phishing rather than token theft; no public exploit has been identified and EPSS sits at the 18th percentile.

Open redirect in the Grav Login plugin (prior to version 3.8.5) allows unauthenticated attackers to weaponize any public Grav installation as a trusted-domain launchpad for phishing. The `twofa_cancel` task accepted a client-controlled `_redirect` POST parameter without nonce validation; `Controller::execute()` forwarded this value through `Grav::getRedirectResponse()` and `Uri::isExternal()`, which confirmed the URL was external but did not block it - enabling seamless transparent redirect to attacker-controlled http, https, or protocol-relative targets. The vendor released a patch in Login plugin 3.8.5 that both adds nonce verification to the `twofa_cancel` task and blocks external client-supplied redirects across all login tasks. No public exploit has been identified and the vulnerability is not in the CISA KEV catalog.

Open redirect in YOOtheme Zoo extension for Joomla (versions prior to 4.1.64) allows unauthenticated network attackers to redirect authenticated users to arbitrary external URLs. The vulnerability exists in CommentController::twitterAuthenticate(), where the referer request parameter is forwarded without validation directly to setRedirect(). No public exploit code has been identified at time of analysis, and no active exploitation is confirmed via CISA KEV.

Full takeover of Oracle Hyperion Infrastructure Technology 11.2.25.0.000 is possible when a remote unauthenticated attacker over HTTP lures an authorized user into interacting with malicious content, exploiting a flaw in the Installation and Configuration component. Because the vulnerability carries a scope change, successful exploitation can extend beyond Hyperion to significantly impact other integrated products, yielding complete confidentiality, integrity, and availability compromise. Oracle rates it CVSS 9.6; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.

Reflected JavaScript injection and open redirect in MyBB forum software before 1.8.40 lets a remote attacker execute script in a victim's browser session. The Contact module (contact.php) takes a redirect target from the 'from' request parameter or the Referer header and passes it to redirect() without validating the URL scheme, so a javascript: URI can be delivered as the destination of the post-submission 'Click here if you don't want to wait any longer' link. CVSS is 9.3; no public exploit identified at time of analysis, and the flaw requires the victim to click the crafted link.

Open redirect in the Grav API plugin (grav-plugin-api) before 1.0.14, bundled with Grav 2.0's admin-next/API stack, allows post-login phishing via a backslash normalization bypass in SsoController::sanitizeReturnTo(). An attacker who can send a crafted OAuth login URL to an authenticated admin victim can supply a returnTo value such as '/\evil.com' that passes the guard rejecting '//' prefixes but is silently normalized by the browser into the protocol-relative URL '//evil.com', redirecting the victim to an attacker-controlled site immediately after a legitimate login. No public exploit has been identified at time of analysis, though the backslash-normalization technique is a well-documented browser behavior; the vendor advisory references a fix in version 1.0.14.

Recursive arbitrary directory deletion in OpenEMR before 8.2.0 is achievable by an unauthenticated attacker through a two-vulnerability chain: a path traversal flaw in standard_tables_manage.php allows the db GET parameter - passed unsanitized to temp_dir_cleanup() - to resolve outside the intended PHP temporary directory, while an open redirect in dicom_frame.php enables delivery of a crafted URL that triggers this deletion inside an authenticated Superuser's active session. The patch is confirmed in OpenEMR 8.2.0 (released 2026-07-08); no active exploitation (CISA KEV) or public proof-of-concept has been identified at time of analysis. The potential for irreversible mass deletion of patient records and EHR runtime data makes this a high-priority patching target despite the social-engineering prerequisite.

Open redirect in chi (go-chi/chi) versions before 5.2.2 allows Host header injection via the RedirectSlashes middleware, enabling attackers to redirect users to arbitrary external domains for phishing and credential theft. Applications using the RedirectSlashes middleware that expose their chi router to environments where the Host header can be forged are directly at risk. No public exploit is identified in CISA KEV; however, a functional proof-of-concept is documented in the GHSA advisory, and the GHSA itself characterizes real-world exploitability as lower-severity because standard browsers and email clients cannot be used to manipulate the Host header.

OAuth authorization code theft in @backstage/plugin-auth-backend prior to 0.29.2 is possible when experimental dynamic client registration or CIMD features are enabled and configured with wildcard-hostname or protocol-less redirect URI allowlist patterns. Full-string glob matching allows a crafted attacker-controlled URI embedding a trusted hostname suffix in its path component to pass the allowlist, delivering authorization codes to the attacker after a victim completes an OAuth flow. No public exploit has been identified and this CVE does not appear in the CISA KEV catalog; real-world impact is sharply bounded by the experimental, disabled-by-default nature of the affected features.

Open redirect in Saurus CMS Community Edition's logout handler allows unauthenticated attackers to redirect authenticated users to attacker-controlled domains or javascript: URIs immediately after session destruction. The vulnerability exists in classes/port.inc.php, where the `url` GET/POST parameter is passed unsanitized into the HTTP Location header with no allowlist, scheme check, or path restriction. A publicly available proof-of-concept demonstrates exploitation; no active exploitation has been confirmed by CISA KEV, and the CVSS 4.0 score of 5.1 with UI:A reflects the social-engineering dependency inherent to post-logout redirect abuse.

Cache-poisoning XSS and open redirect in Etherpad (ep_etherpad-lite 2.1.0-3.0.0) stem from unsanitized reflection of the attacker-controlled `x-proxy-path` HTTP request header into admin HTML/JS/CSS assets and into a 302 Location target. The most severe vector is cache-poisoning: because no `Vary: x-proxy-path` header was emitted, a CDN or shared reverse proxy caches a single attacker-crafted response and serves the injected script to every authenticated admin who subsequently loads `/admin/index.html`, requiring no further attacker involvement. The timeslider redirect independently allows open redirect via protocol-relative URL injection (`//evil.example`). No CISA KEV listing is confirmed; a working PoC curl command is published in the GitHub advisory GHSA-fjgc-3mj7-8rg8.

Open redirect in Meeting Room Booking System (MRBS) prior to version 1.12.2 enables unauthenticated attackers to craft malicious URLs that silently forward victims from a trusted MRBS domain to any attacker-specified site, enabling phishing and credential harvesting. The vulnerability is specifically present in MRBS kiosk mode, where the application accepts a query-supplied redirect destination without validating it against an allowlist or trusted domain list. No public exploit code or CISA KEV listing has been identified; the vendor has released a fix in version 1.12.2 with no available workarounds.

Open redirect in the oauth-server component of Red Hat OpenShift Container Platform 4 allows a remote attacker to craft a malicious OAuth grant URL that, upon interaction by an authenticated user, silently redirects that user to an attacker-controlled site. The root cause is the absence of server-side validation on the 'then' parameter in the grant approval handler (CWE-601), making every OpenShift OAuth endpoint a potential phishing launcher. No public exploit code or CISA KEV listing has been identified at time of analysis; the CVSS 4.3 Medium score reflects the required user interaction as the primary limiting factor.

Open redirect exploitation in SAP's python-pyodata library (versions before 1.11.2) allows a malicious or compromised OData service to capture sensitive authentication information transmitted by the client and inject untrusted data into the consuming application. Applications using pyodata that connect to externally controlled or attacker-reachable OData endpoints are at risk of credential disclosure and data integrity compromise. No public exploit code has been identified at time of analysis, and the vulnerability has not been listed in CISA KEV, but a vendor-released patch is available at version 1.11.2.

Token content validation bypass in SAP Approuter (node.js package < 23.0.0) enables an unauthenticated remote attacker to exfiltrate sensitive credential material to an attacker-controlled destination by submitting a specially crafted token. The flaw, classified as CWE-601 (Open Redirect), exploits insufficient URL or destination validation within the Approuter's token-processing logic under specific non-default configurations, yielding high confidentiality impact and low integrity and availability impact. No public exploit or active exploitation is confirmed at time of analysis; vendor patch is available via SAP Approuter 23.0.0 per SAP Security Note 3786038.

Open redirect in Phoenix LiveView's redirect/2 allows an unauthenticated remote attacker to send a victim's browser to an arbitrary external origin by embedding ASCII tab (\t), line feed (\n), or carriage return (\r) in the :to path argument. The private validate_local_url!/2 guard in lib/phoenix_live_view.ex rejects leading double-slashes and backslashes but does not strip or reject these whitespace control characters; browsers silently discard them before URL resolution, so a payload such as /<TAB>/example.com validates as a local path yet resolves to the scheme-relative URL //example.com. Affected versions span three release trains: 0.5.0–1.0.18, 1.1.0-rc.0–1.1.32, and 1.2.0-rc.0–1.2.8. No public exploit code or CISA KEV listing has been identified at time of analysis.

Open redirect in the Home Assistant Android Companion App (prior to 2026.6.1) enables credential phishing attacks against new users via crafted homeassistant://invite deep links. Because no screen in the invitation or onboarding flow displays the parsed server hostname before the WebView commits to it, an attacker who delivers a malicious invite link can silently redirect the victim's onboarding session to an attacker-controlled server presenting a look-alike login page. No public exploit code has been identified at time of analysis; the CVSS score of 4.3 (C:L) understates real-world impact given that captured credentials yield full smart-home access.

Open redirect in the Webbox component of TeamDavid (Tobit Laboratories AG's Microsoft 365 alternative) enables unauthenticated network attackers to craft URLs on the trusted TeamDavid domain that silently redirect visiting users to arbitrary external sites by supplying an unsanitized value in the 'replyUrl' parameter. All versions through Rollout 524 are affected per the CPE listing. This issue was disclosed as part of a coordinated report of 22 CVEs in the David platform by InfoGuard and reported to NCSC.ch; no confirmed active exploitation or public exploit code has been identified at time of analysis.

HTTP header injection in Tobit Laboratories AG TeamDavid's Webbox component allows unauthenticated network attackers to manipulate HTTP response headers by embedding URL-encoded newline characters via the unsanitized 'cType' URL parameter, enabling open redirect attacks and potential HTTP response splitting. All Webbox deployments through Rollout 524 are affected, as catalogued by NCSC.ch and detailed in InfoGuard's research covering 22 CVEs in the TeamDavid platform. No confirmed active exploitation (CISA KEV) or public exploit code has been identified at time of analysis; the CVSS 4.0 score of 5.3 reflects medium severity gated by required user interaction.

Open redirect and HTTP response header injection in the Webbox component of TeamDavid (by Tobit Laboratories AG) allow unauthenticated network attackers to manipulate 302 redirect responses by supplying encoded characters in user-controlled URL parameters. Using URL-encoded dots (%2e), an attacker can steer victims toward attacker-registered lookalike TLD domains (e.g., redirecting from a .com application to an attacker-owned .company domain), while URL-encoded line feeds enable HTTP response splitting to inject arbitrary headers. No public exploit or CISA KEV listing has been identified at time of analysis; this CVE is one of 22 disclosed against the David product suite by infoguard.ch researchers.

Open redirect in html_sanitize_ex (Elixir, versions 0.3.1 through 1.5.2) allows remote attackers to force page visitors to navigate to attacker-controlled URLs by injecting `<meta http-equiv="refresh">` elements that the HTML5 scrubber (HtmlSanitizeEx.Scrubber.HTML5) passes through intact into sanitized output. Because a meta refresh acts at document scope rather than fragment scope, it overrides the host page's navigation regardless of where the sanitized fragment is embedded. The CVE description explicitly rules out JavaScript execution - this is a pure redirect primitive - and no public exploit has been identified at time of analysis.

html_sanitize_ex's HTML5 scrubber (versions 0.3.1 through 1.5.2) permits the `form` and `formaction` attributes to survive sanitization on `<input>` elements, enabling unauthenticated remote attackers to silently hijack existing page forms and redirect victim submissions - including credentials - to an attacker-controlled endpoint. The attack exploits HTML's native form association model (no script required), but succeeds only when the rendering page already contains a form with a known or guessable `id` attribute. No active exploitation or CISA KEV listing has been identified at time of analysis, and no EPSS score was included in source data.

Unauthenticated open redirect in DjangoCRM's toggle_default_sorting view exposes users to same-site phishing and referrer-based token leakage. The endpoint is the sole route in common/urls.py lacking a login_required or staff_member_required decorator, and it redirects to a caller-supplied next_url GET parameter after only a domain-level check via secure_url() - permitting redirection to any arbitrary same-site path without authentication. No public exploit has been identified at time of analysis and no CISA KEV listing exists, but the unauthenticated attack surface combined with potential token harvest in redirect chains elevates practical risk beyond the 4.3 CVSS score alone.

Open redirect in HUMANIST Digital Human Resources (versions 26.0 through pre-26.1) enables authenticated attackers to craft malicious URLs that silently forward victims to attacker-controlled phishing sites. The CVSS vector (PR:L/UI:R/S:C) confirms the vulnerability requires a low-privileged account to generate the redirect link and victim interaction to trigger it, with scope change reflecting cross-domain trust abuse. No public exploit code or active exploitation has been identified at time of analysis; this was reported by TR-CERT under advisory TR-26-0737.

Open redirect in Clearfy Cache WordPress plugin (versions before 2.4.3) allows unauthenticated attackers to redirect site visitors to arbitrary external URLs by exploiting the Cyrlitera old-URL redirect handler, which passes a decoded request URI to an unsafe redirect function without target validation. Exploitation requires that the non-default Cyrlitera redirect option is enabled on the target site, and a victim must interact with an attacker-crafted URL. No public KEV listing exists, EPSS sits at the 4th percentile (0.14%), but a publicly available proof-of-concept has been published by WPScan.

Open redirect in kodbox 1.67 Build 02 SSO API Login allows unauthenticated remote attackers to redirect victims to arbitrary external URLs by manipulating the callbackUrl parameter at the /user/sso/apiLogin endpoint. The CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:P) confirms network-accessible, low-complexity exploitation requiring only passive user interaction - a victim clicking a crafted SSO link - with no authentication or special configuration needed from the attacker's side. A proof-of-concept exploit has been publicly disclosed on GitHub (E:P), lowering the exploitation barrier, though no CISA KEV listing indicates confirmed widespread exploitation at time of analysis.

Open redirect in Grav's form plugin (getgrav/grav-plugin-form) versions 9.1.11 through 9.1.12 allows unauthenticated form submitters to cause the server to issue a 302 redirect to an arbitrary external URL, enabling phishing attacks against site visitors. The vulnerability exists because the redirect process action, introduced in v9.1.11, evaluates user-supplied form field values through Twig expressions without sanitizing the resulting URL, and Grav::redirect() passes that output to the browser without origin validation. No public exploit code has been identified at time of analysis, and no active exploitation is confirmed in CISA KEV, though the low attack complexity and zero-authentication requirement make this straightforward to abuse against any site with a susceptible form blueprint.

Open redirect in the better-auth npm authentication library before version 1.1.21 enables one-click account takeover when a victim follows a crafted link. The trustedOrigins validation logic - responsible for gatekeeping callbackURL parameters - contains bypass flaws in both its absolute URL matching and wildcard domain pattern handling, allowing an attacker-supplied URL to pass origin checks and redirect victims to an attacker-controlled destination. Because callback redirects in authentication flows commonly carry sensitive tokens such as password-reset credentials, a successful redirect exfiltrates those tokens and allows full account compromise. No public exploit or CISA KEV listing has been identified at time of analysis.

Post-login redirect validation in GeoNetwork's OAuth2/OIDC and Keycloak SSO authentication filters can be bypassed to redirect authenticated users to attacker-controlled external sites, enabling phishing attacks. Versions 3.12.0 through 4.2.15 and 4.4.0 through 4.4.10 are affected across both supported and archived release lines. The bypass exploits the filter's failure to reject protocol-relative URLs (e.g., //evil.example.com) that Java treats as relative paths but browsers resolve as absolute external destinations; no public exploit has been identified at time of analysis and the vulnerability is not listed in CISA KEV.

Open redirect in Serendipity's exit.php allows unauthenticated attackers to craft URLs on a legitimate blog domain that silently forward victims to arbitrary attacker-controlled sites. All Serendipity installations prior to version 2.6.1 are affected, but only when the Track Exits plugin is active and configured with commentredirection set to "s9y" - a non-default, explicit setting. No public exploit code and no CISA KEV listing exist at time of analysis; the CVSS 4.0 score of 2.1 reflects limited direct technical impact, though the phishing, malware-delivery, and URL-reputation-bypass potential represents meaningful real-world risk for organizations where blog domain credibility matters.

Server-Side Request Forgery in Google mcp-toolbox versions 0.3.0 through 1.4.0 lets remote attackers coerce the toolbox into making unauthorized requests to internal or arbitrary endpoints by supplying a crafted path parameter that triggers an open redirect or destination swap on the backend. Because the HTTP client in internal/sources/http/http.go was initialized without a CheckRedirect policy or target-IP validation, baseline parameter sanitization is bypassed once the server follows the redirect. There is no public exploit identified at time of analysis (CVSS 4.0 carries E:U, Exploit Unproven), and the flaw is notably reachable via malicious data-driven LLM prompts, not just direct attacker input.

Open redirect in IBM Planning Analytics Local versions 2.1.0 through 2.1.21 lets remote attackers craft URLs that bounce authenticated users to attacker-controlled external sites. When the product is deployed with SSO authentication, the redirect can leak session tokens carried in the flow, enabling session hijacking. No public exploit identified at time of analysis; this is not on CISA KEV and no POC is referenced in the provided data.

Open redirect in Leantime 3.6.2's Login controller lets unauthenticated attackers craft login URLs where the `redirectUrl` POST parameter bypasses PHP's `FILTER_SANITIZE_URL` validation - which strips illegal characters but never performs origin-validation - to redirect authenticated users to external attacker-controlled sites. Affected are all deployments of Leantime 3.6.2 with a web-accessible login endpoint, the primary use case being phishing and credential theft by abusing the trusted Leantime domain as a delivery vehicle. No public exploit is confirmed in CISA KEV, but publicly available exploit code exists per VulnCheck and a GitHub Security Advisory (GHSA-wprg-q8m6-jhp9).

Navigation restriction bypass in Google Chrome for iOS (prior to 151.0.7922.72) enables a remote attacker to redirect users to unintended URLs via a crafted HTML page, exploiting a CWE-601 open redirect condition. The Chromium team rated this Low severity, consistent with the CVSS 4.3 score and the limited integrity-only impact (no confidentiality or availability consequences). No public exploit identified at time of analysis, and the EPSS score of 0.18% (8th percentile) reflects minimal exploitation interest from the threat actor community.

Open redirect in Dify's OAuth flow enables remote attackers to hijack post-authentication redirections, sending users to attacker-controlled sites that can harvest OAuth tokens or credentials. The flaw resides in the AppInitializer component's oauth_redirect_url handling, where the redirect destination is not validated against an allowlist. Exploitation requires user interaction - a target must follow a crafted link - but no authentication is required of the attacker, making phishing-based delivery straightforward. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.

Open redirect in MISP installation scripts allows unauthenticated remote attackers to craft malicious URLs that leverage a missing trailing slash in the Apache HTTP-to-HTTPS redirect directive. When a user follows a crafted link on the legitimate MISP domain, the redirect appends attacker-controlled path content directly to the hostname, causing the browser to interpret the attacker’s domain as the destination host. This can lead to phishing and credential collection, though no active exploitation has been identified and a vendor patch is available.

An open redirect in the post-login redirect feature of an unspecified web UI allows unauthenticated remote attackers to trick users into visiting malicious websites, leading to potential credential theft and loss of service. The vulnerability has a CVSS score of 6.1 and is classified under CWE-601. No information about active exploitation, public exploits, or fixes is currently available.

An open redirect vulnerability in Milk admin through version 0.9.8 allows an authenticated attacker with high privileges to craft a request that redirects users to arbitrary external URLs, enabling phishing or credential theft. Public exploit code exists on GitHub, but the vulnerability is not actively exploited per CISA SSVC and has a low EPSS probability of 0.30%. The CVSS vector indicates high privileges and no user interaction required, which is unusual for open redirects and may indicate a server-side forced redirect.

Open redirect vulnerability in Contact Form 7 WordPress plugin prior to version 2.5 allows unauthenticated attackers to redirect victims to arbitrary external sites after the Stripe checkout flow. Publicly available exploit code exists, but no active exploitation has been confirmed. With a CVSS score of 4.7 (medium) and low EPSS not provided, the risk is moderate due to required user interaction and limited impact.

Open redirect in React Router (npm package, versions 6.0.0 through 7.17.x) allows bypass of the prior CVE-2025-68470 patch via attacker-supplied paths containing mixed backslash and forward-slash sequences (e.g., \\evil.com, /\evil.com, \/evil.com) passed to navigation APIs including useNavigate() and the Link component. Browsers interpret these malformed protocol-relative URL patterns as pointing to external hosts, enabling unexpected external navigation. No active exploitation (CISA KEV) or public proof-of-concept has been identified at time of analysis; vendor-released patch v7.18.0 is available.

Open redirect in React Router's `resolvePath` utility allows attackers to craft navigation URLs using protocol-relative paths (`//external.com`) or colon-containing relative paths that the library fails to normalize, resulting in external redirects or XSS execution in the victim's browser. Affected packages are `react-router` (npm) 7.9.6-7.12.0 and `react-router-dom` (npm) 6.30.2-6.30.4; only `react-router` has a confirmed fix (7.13.0). No public exploit code and no CISA KEV listing have been identified at time of analysis, though the CVSS scope-change and high confidentiality impact reflect cross-origin session theft potential via XSS.

Server-side request forgery in PHPOffice PhpSpreadsheet (>= 4.0.0 through 5.8.0, plus older branches back to 2.0.0) lets an attacker bypass the WEBSERVICE() domain whitelist introduced in 5.4.0 by chaining through an HTTP 302/301 redirect. Because the whitelist only validates the initial URL host while file_get_contents() silently follows redirects without re-validation, an attacker who can upload a crafted XLSX to an app that calls setDomainWhiteList() and getCalculatedValue() can pivot to internal-only targets and read the full HTTP response (up to 32,767 bytes) as a cell value. Publicly available exploit code exists (a full PoC and lab reproduction are in the GitHub advisory); no public exploit identified as actively used in the wild and it is not in CISA KEV.

Server-Side Request Forgery (SSRF) and open redirect in Next.js rewrite/redirect rules when the destination hostname is dynamically constructed from user-controlled input. Versions 12.0.0 to 15.5.20 and 16.0.0 to 16.2.10 are affected, allowing a remote attacker to proxy requests to arbitrary hosts or redirect users. Patched versions 15.5.21 and 16.2.11 are available; no active exploitation has been reported.

DOM-based cross-site scripting in Unblu Spark, reachable via an open-redirect flaw (CWE-601), lets remote attackers execute arbitrary JavaScript in a victim's browser after luring them to a crafted link. When Spark runs with com.unblu.identifier.siteEmbeddedSetup=true it shares the host application's origin, so injected script inherits full access to the host app's cookies, DOM, and same-origin APIs, expanding the blast radius well beyond Unblu itself and driving the CRITICAL 9.3 (CVSS 4.0) rating for on-prem embedded deployments. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.

Unauthorized access to critical data in Oracle Production Scheduling (versions 12.2.3 through 12.2.15) is achievable by unauthenticated remote attackers via a network-based authentication bypass in the Internal Operations component, though exploitation requires high attack complexity and human interaction from a third party. The confidentiality impact is complete - attackers can access all data accessible to Production Scheduling - while integrity and availability remain unaffected. No public exploit code or CISA KEV listing has been identified at time of analysis; Oracle disclosed this through the July 2026 Critical Patch Update.

Oracle HRMS (Republic of Korea) versions 12.2.3 through 12.2.15 exposes a network-accessible flaw in the Korean Payroll component that allows unauthenticated attackers to read a subset of HR data and perform unauthorized insert, update, or delete operations on payroll records. Exploitation requires victim-side human interaction, consistent with a client-side attack pattern (e.g., CSRF or reflected XSS) that bypasses access controls - corroborated by the 'Authentication Bypass' intelligence tag. No public exploit code and no CISA KEV listing have been identified at time of analysis; the Oracle CPU July 2026 advisory is the authoritative remediation source.

Account/application takeover in Oracle WebCenter Content: Imaging (Core component of Fusion Middleware) affects supported versions 12.2.1.4.0 and 14.1.2.0.0, where a remote unauthenticated attacker who lures a legitimate user into interacting with malicious content over HTTP can fully compromise the Imaging application. Oracle rates it CVSS 3.1 7.5 with high confidentiality, integrity, and availability impact, but flags it as difficult to exploit (AC:H) and dependent on user interaction. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; a fix ships in the Oracle July 2026 Critical Patch Update.

Cross-user attack in Oracle PeopleSoft Enterprise PeopleTools 8.61 and 8.62 enables a low-privileged network attacker to compromise confidentiality and integrity of data across component boundaries when a victim user interacts with attacker-controlled content. The Security component is the attack surface, consistent with stored or reflected client-side injection (e.g., XSS) that hijacks session or data context of another user. No public exploit identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.

Cross-boundary exploitation in Oracle PeopleSoft Enterprise PeopleTools versions 8.61 and 8.62 allows a low-privileged, network-authenticated attacker to compromise confidentiality and integrity of data - including in additional downstream PeopleSoft products - by inducing a victim user to perform an action via HTTP. The CVSS scope-change indicator (S:C) and required user interaction (UI:R) are characteristic of a client-side injection class (e.g., stored or reflected XSS within the Security component) that crosses trust boundaries. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.

Full takeover of the JDBC component in Oracle Database Server is achievable by a high-privileged network attacker operating via Oracle Net, contingent on inducing human interaction from a separate party. All three actively maintained Oracle Database release tracks - 19c, 21c, and 23ai - are confirmed affected across their respective patch set ranges. No public exploit code or CISA KEV listing has been identified at time of analysis; however, successful exploitation yields complete confidentiality, integrity, and availability compromise of the JDBC layer.

Unauthorized access to critical data in Oracle PeopleSoft Enterprise PeopleTools 8.61 and 8.62 is possible via the bundled OpenSearch Dashboards component, where a remote unauthenticated attacker can compromise confidentiality by luring a victim into interacting with attacker-supplied content (UI:R). The scope-change and confidentiality-only vector (S:C/C:H/I:N/A:N), combined with the vendor's 'Authentication Bypass' tag, is characteristic of a client-side flaw such as cross-site scripting in the Dashboards UI that lets an attacker read data across products the victim can reach. No public exploit has been identified at time of analysis, and it is not listed in CISA KEV; it is addressed in Oracle's July 2026 Critical Patch Update.

Cross-site-scripting-style compromise of Oracle PeopleSoft Enterprise PeopleTools 8.62 (PIA Core Technology) lets a remote, unauthenticated attacker who lures an authenticated user into interacting with a crafted HTTP request achieve limited read/write access to PeopleSoft data and cause partial denial of service. The scope-change flag (S:C) means the impact can extend beyond PeopleTools into additional integrated products. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; CVSS 3.1 base score is 7.1.

Cross-site scripting or session-hijacking class vulnerability in Oracle Enterprise Manager Base Platform's UI Framework component exposes versions 13.5 and 24.1 to unauthorized data access and manipulation via HTTPS. An unauthenticated remote attacker can exploit this with no privilege prerequisite, but requires a victim user to interact with attacker-controlled content, after which the attack scope extends beyond the directly targeted component. Successful exploitation yields limited unauthorized read and write access to Enterprise Manager data. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.

Full takeover of Oracle Enterprise Manager Base Platform (versions 13.5 and 24.1) is possible when an unauthenticated remote attacker abuses a flaw in the Metadata Plugin component over HTTPS and induces an authorized user to interact with attacker-controlled content. Because the compromise yields high confidentiality, integrity, and availability impact against a central management console for Oracle estates, one successful attack can hand an adversary control of the platform. There is no public exploit identified at time of analysis and no CISA KEV listing, but the low attack complexity and unauthenticated network vector make it a priority patch in this quarter's Oracle Critical Patch Update.

Open redirect in Universal Software Inc. FlexCity (versions 5.536.0 through 11052026) enables remote unauthenticated attackers to craft trusted-domain URLs that silently redirect victims to arbitrary external sites, facilitating phishing and credential harvesting. The CVSS 6.1 (Medium) vector carries S:C (Changed scope), confirming the impact escapes the application boundary to affect users on third-party systems. No public exploit code and no CISA KEV listing have been identified at time of analysis, reported by TR-CERT.

Open redirect in Trino 481's OAuth2/OIDC authentication component allows remote, unauthenticated attackers to manipulate the redirect_uri parameter in ExternalUriInfo.java, redirecting authenticated users to attacker-controlled external sites. Exploitation requires user interaction - a victim must follow a crafted authentication URL - making this primarily a phishing and token-harvesting enabler rather than a direct system compromise vector. No active exploitation has been confirmed (not in CISA KEV), no public exploit code exists, and the trinodb project had not responded to the responsible disclosure report at time of analysis.

Open redirect in the @astrojs/node standalone server's static file handler allows remote attackers to redirect authenticated or unauthenticated users to arbitrary external hosts via crafted slash-backslash paths. Versions 8.1.0 through 11.0.1 of the npm package fail to normalize backslash characters before the internal-path prefix check in `isInternalPath()`, causing the 301 `Location` header to echo back paths like `/\attacker.com/page` which browsers resolve as `//attacker.com/page` per the WHATWG URL specification. No public exploit is identified at time of analysis; exploitation is gated by a non-default configuration option and requires social engineering to deliver a crafted link to a victim.

Open redirect in cal.diy's conferencing OAuth callback endpoint (through v6.2.0) enables remote unauthenticated attackers to silently redirect authenticated users to attacker-controlled URLs by injecting a malicious external URL into the unsigned `onErrorReturnTo` field of the OAuth `state` parameter. Because the state payload is never cryptographically signed or validated against a trusted origin allowlist, the endpoint blindly issues a 301 redirect to any URL supplied by the caller, making the trusted cal.diy domain a transparent phishing launchpad. No public exploit code has been identified at time of analysis, but exploitation requires only a crafted URL - no special tooling - with user interaction as the sole barrier.

Open redirect in Hikashop, the Joomla e-commerce extension, affects all versions from 1.0.0 through 6.5.1 and allows remote unauthenticated attackers to craft legitimate-looking store URLs that silently forward victims to arbitrary external destinations. Exploitation requires victim interaction (a clicked link), making this a phishing and credential-harvesting enabler rather than a direct infrastructure threat. No public exploit code has been identified at time of analysis, and EPSS places exploitation probability at just 0.13% (3rd percentile), consistent with SSVC's classification of exploitation status as none.

Open redirect and token-theft in dataCycle-CORE (all versions up to and including 25.07.3) lets a low-privileged authenticated API user inject attacker-controlled `forwardToUrl` and `redirectUrl` parameters into password-reset and confirmation email flows, which lack host allowlisting. Because a live reset/confirmation token can be appended to an attacker-controlled destination, and users are redirected off-site after completing a reset, an attacker can capture tokens, hijack confirmations, and stage convincing phishing from a trusted-domain email. No public exploit or CISA KEV listing exists at time of analysis; the issue is fixed in 26.06.08.

IBM Engineering AI Hub versions 1.0.0, 1.1.0, and 1.2.0 expose an open redirect flaw (CWE-601) that enables remote attackers to silently redirect authenticated or unauthenticated users to arbitrary attacker-controlled websites by supplying a crafted URL. The vulnerability requires no privileges but does require user interaction, making it a phishing-enablement risk rather than a direct system compromise vector. No public exploit code or CISA KEV listing exists at time of analysis; IBM has released a patch per advisory https://www.ibm.com/support/pages/node/7279964.

Open redirect vulnerability in IBM Verify Identity Access and Security Verify Access allows remote unauthenticated attackers to craft malicious URLs that redirect victims to arbitrary attacker-controlled websites, enabling phishing campaigns that exploit the trusted reputation of enterprise IAM infrastructure. Affected deployments span both on-premises and containerized editions across IBM Verify Identity Access 11.0-11.0.2 and IBM Security Verify Access 10.0-10.0.9.1. No public exploit code or CISA KEV listing exists at time of analysis; IBM has released a patch via advisory at https://www.ibm.com/support/pages/node/7279510.

Session token theft in SigNoz through 0.133.0 lets unauthenticated attackers hijack any user account on instances configured with Google OAuth, SAML, or OIDC single sign-on. Because the unauthenticated sessions-context endpoint accepts an attacker-controlled 'ref' parameter that is embedded unvalidated into the SSO state/redirect, an attacker crafts a login URL that returns the victim's access and refresh tokens to an attacker-controlled host once the victim completes SSO. Reported by VulnCheck (CWE-601, open redirect), publicly available exploit code exists, though it is not listed in CISA KEV and EPSS was not provided.

Open redirect in Axivion Dashboard's OAuth/OIDC login flow allows an attacker to silently redirect an authenticated user to an arbitrary external URL after successful sign-in. All Axivion versions are affected per the wildcard CPE (cpe:2.3:a:qt:axivion:*). A threat actor can exploit this for phishing - credential harvesting or second-factor theft - by embedding a crafted login URL that terminates on a convincing look-alike site rather than the legitimate dashboard. No public exploit has been identified at time of analysis and the vulnerability is not listed in CISA KEV.

Reflected cross-site scripting in MantisBT 2.28.3 and earlier lets remote attackers inject HTML into the unauthenticated /admin/install.php installer page through six user-supplied parameters echoed via an unescaped printf format string. Because the application ships a script-src 'self' Content Security Policy that lacks a form-action directive, an attacker cannot run inline JavaScript but can render fake credential-harvesting login forms, perform <meta>-based open redirects, and overlay attacker HTML via CSS injection on the legitimate admin page. There is no public exploit identified at time of analysis, no CISA KEV listing, and no CVSS/EPSS score in the provided data; the issue was reported by watchTowr and fixed in 2.28.4.

Reflected cross-site scripting in MantisBT's /admin/install.php (versions 2.28.3 and earlier) lets remote attackers inject HTML through six unescaped, user-supplied parameters echoed by print_test_result(). Although the page's Content-Security-Policy (script-src 'self') blocks inline JavaScript, the missing form-action directive permits credential-phishing form injection, <meta>-based open redirects, and CSS overlay attacks against the trusted admin origin. The advisory states no authentication is required; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.

Open redirect in Redash versions 5.0.2 through 26.3.0 allows unauthenticated attackers to craft a login URL that silently forwards authenticated users to an attacker-controlled external site. The flaw in get_next_path() stripped scheme and netloc from the next parameter but failed to reject or normalize URLs with three or more leading slashes - a pattern browsers interpret as an absolute external reference (e.g., /login?next=////evil.com). No public exploit or CISA KEV listing has been identified at time of analysis, though the bypass technique is trivially reproducible from the advisory's own example.

Password reset token poisoning in the Grav API plugin (grav-plugin-api) before 1.0.4 lets an unauthenticated attacker hijack the account recovery flow by supplying an attacker-controlled host in the admin_base_url field (or Referer/Origin headers) of the POST /api/v1/auth/forgot-password request. Because the reset email's link is built from this unvalidated host, a victim who clicks it leaks a valid, unexpired reset token to the attacker, yielding full account takeover. No public exploit is identified at time of analysis, and it is not in CISA KEV, but VulnCheck's advisory and vendor GHSA-5xc4-j99p-cp4m confirm the flaw and a 1.0.4 fix.

Open redirect in Adobe Commerce, Adobe Commerce B2B, Magento Open Source, and the Adobe Commerce Webhooks Plugin allows remote unauthenticated attackers to construct malicious URLs that silently forward victims to attacker-controlled phishing sites, enabling credential theft and account takeover. The flaw spans the full product family across multiple supported version branches and was disclosed by Adobe via Security Bulletin APSB26-73 with patches released in July 2026. No public exploit code has been identified at time of analysis, and SSVC rates exploitation status as 'none' with EPSS at 0.74% (50th percentile), indicating limited real-world exploitation signal despite broad product prevalence.