CVE-2026-12622 is an open redirect vulnerability in the Microchip GridTime 3000 GNSS Time Server affecting versions from 1.0r0.03 through 1.1r0.0. The issue occurs in the password change form submission, where an attacker can craft URLs that redirect users to untrusted external sites. This vulnerability is classified as CWE-601 and has a CVSS 4.0 score of 5.3, reflecting a medium level of risk. No official remediation or patch has been documented at this time, and no known exploits are reported in the wild.

The vulnerability allows attackers to redirect users to potentially malicious external websites via the password change form. This could facilitate phishing or social engineering attacks by misleading users to untrusted sites. However, the vulnerability does not require user interaction (UI:N) and has low vector complexity (AC:L), but requires low privileges (PR:L). The overall impact is medium severity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should exercise caution when interacting with password change URLs and validate the legitimacy of URLs before clicking. Monitor Microchip's advisories for updates on patches or official mitigations.