CVE-2026-18721 describes an open redirect vulnerability in kalcaddle kodbox version 1.67 Build 02. The flaw is located in the SSO API Login component, specifically in the processing of the callbackUrl argument in the /user/sso/apiLogin endpoint. Manipulation of this parameter allows an attacker to redirect users to arbitrary URLs, potentially facilitating phishing or other social engineering attacks. The vulnerability can be exploited remotely without authentication. The vendor has not issued a response or patch, and no remediation level is indicated in the available data.

Successful exploitation of this vulnerability allows an attacker to redirect users to arbitrary external websites, which can be leveraged for phishing or redirecting users to malicious sites. The vulnerability does not require privileges or user interaction beyond clicking a crafted link. The CVSS 4.0 base score is 5.3 (medium severity), reflecting network attack vector, low complexity, no privileges required, user interaction required, and limited impact on confidentiality and integrity.

No official patch or remediation guidance is currently available from the vendor. Users and administrators should monitor vendor communications for updates. In the interim, consider implementing web application firewall (WAF) rules to detect and block suspicious redirect attempts involving the callbackUrl parameter. Educate users to be cautious of unexpected redirects originating from the affected application.