CVE-2025-60868: Alt Redirect · Authentication Bypass by Spoofing
Source CVE Database V5
Not known to be exploited · CVSS 6.5 Medium.
Data as of 26 Oct 2026, 11:07 UTC
- EPSS
- 0.2% chance of exploitation in 30 days – higher than 13% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:NExploitation evidence
Disclosed: evidence found.
CVE published 10 Oct 2025
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.
What to do
AI-suggested
European organizations should immediately audit their use of the Alt Redirect addon within Statamic environments to identify if version 1.6.3 or similar vulnerable versions are deployed. Until a patch is available, implement strict input validation and normalization at the web application firewall (WAF) or reverse proxy level to detect and block query strings with case variations, encoded keys, or duplicate parameters that could bypass sanitization. Employ caching mechanisms that validate cache keys rigorously to prevent poisoning. Monitor web server and application logs for unusual query string patterns or repeated malformed requests indicative of exploitation attempts. Engage with Statamic or addon maintainers to obtain updates or patches as soon as they are released. Consider temporarily disabling the "Query String Strip" feature if it cannot be secured, or replace the addon with alternative solutions that properly sanitize query parameters. Conduct penetration testing focusing on query string manipulation to verify the effectiveness of mitigations. Maintain incident response readiness to quickly address any exploitation attempts. Document all mitigation steps and communicate risks to relevant stakeholders.
Description
The Alt Redirect 1.6.3 addon for Statamic fails to consistently strip query string parameters when the "Query String Strip" feature is enabled. Case variations, encoded keys, and duplicates are not removed, allowing attackers to bypass sanitization. This may lead to cache poisoning, parameter pollution, or denial of service.