CVE-2026-39985 is an open redirect vulnerability (CWE-601) in the LORIS web application used for neuroimaging research data management. The vulnerability arises from improper validation of the redirect parameter upon user login, which could be manipulated to redirect users to arbitrary external URLs. This could potentially be used in phishing or social engineering attacks to trick users into visiting malicious sites. The flaw affects LORIS versions before 27.0.3 and versions from 28.0.0 up to but not including 28.0.1. The issue is resolved in versions 27.0.3 and 28.0.1. The CVSS 3.1 base score is 4.3, reflecting a medium severity with network attack vector, low attack complexity, no privileges required, user interaction required, and limited confidentiality impact.

The vulnerability allows an attacker to craft URLs that redirect users to untrusted external sites after login, which could facilitate phishing or social engineering attacks. There is no direct impact on data confidentiality, integrity, or availability. No known exploitation in the wild has been reported.

The vulnerability is fixed in LORIS versions 27.0.3 and 28.0.1. Users should upgrade to one of these versions or later to remediate the issue. Since no official vendor advisory or patch links are provided, verify the upgrade availability from the official LORIS project sources. No additional mitigation steps are indicated by the vendor advisory.