CVE-2024-58389: URL Redirection to Untrusted Site ('Open Redirect') in HoloViz Panel

CVE-2024-58389 is an open redirect vulnerability in HoloViz Panel affecting versions >=1.2.2 and <1.9.0. The vulnerability arises from insufficient validation of the 'next' query parameter in panel/auth.py. This parameter is stored in a 'next_url' cookie by BasicLoginHandler and PasswordLoginHandler, which can be manipulated to redirect authenticated users to arbitrary external URLs controlled by an attacker after successful login.

An attacker can craft login URLs that redirect users to malicious external sites after login, potentially facilitating phishing or other social engineering attacks. The vulnerability requires user interaction (clicking a crafted link) and does not allow direct system compromise or privilege escalation. The CVSS 4.0 score is 5.1 (medium severity), reflecting network attack vector, low complexity, no privileges required, user interaction needed, and limited scope and impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should avoid clicking on untrusted login links containing 'next' parameters. Vendors or administrators should monitor for updates and apply official patches once released.