CVE-2026-39985 is an open redirect vulnerability (CWE-601) in the LORIS web application used for neuroimaging research management. The vulnerability arises because the redirect parameter on login does not validate that the URL is within the LORIS domain, allowing attackers to craft links that redirect users to arbitrary external sites. This can be exploited to trick users into visiting malicious URLs. The vulnerability affects LORIS versions before 27.0.3 and versions from 28.0.0 up to but not including 28.0.1. The issue is resolved in versions 27.0.3 and 28.0.1. The CVSS 3.1 base score is 4.3, reflecting a medium severity with network attack vector, low complexity, no privileges required, user interaction needed, and limited confidentiality impact.

The vulnerability could allow an attacker to redirect users to untrusted external websites via crafted login URLs, potentially facilitating phishing or social engineering attacks. There is no direct impact on data confidentiality, integrity, or availability reported. No known exploits in the wild have been documented.

Upgrade LORIS to version 27.0.3 or 28.0.1 or later, where the open redirect vulnerability is fixed. Since the application is self-hosted, administrators should apply these updates promptly. Patch status is not explicitly confirmed via vendor advisory in the input data, but the description states the issue is fixed in these versions. No additional mitigation steps are indicated.