Concrete CMS versions 9.5.0 through 9.5.2 are vulnerable to an open redirect issue through the rcURL parameter. This vulnerability enables attackers to create links within the site's domain that redirect users to external sites after login or during registration flows. The vulnerability is absent in versions before 9.5.0, which do not implement the rcURL parameter or associated allowlist. The vulnerability has been assigned CVE-2026-81913 and a CVSS v4.0 base score of 5.3, indicating medium severity.

An attacker can exploit this vulnerability to redirect authenticated users or new registrants to malicious external websites. This can facilitate phishing campaigns and credential theft by leveraging the trust users place in the legitimate site domain. There is no indication of privilege escalation or direct code execution. The impact is primarily on user trust and potential credential compromise.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided in the available data. Users should monitor the Concrete CMS security advisories for updates and consider restricting or validating redirect parameters as a temporary mitigation.