CVE-2026-40039 describes an open redirection vulnerability in Pachno 1.0.6. The vulnerability arises from improper validation of the return_to parameter, which attackers can manipulate to redirect users to external, potentially malicious websites. This can facilitate phishing attacks by deceiving users into entering credentials on attacker-controlled sites. The vulnerability is remotely exploitable without privileges and requires user interaction. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges required, user interaction required, and high impact on confidentiality.

Successful exploitation enables attackers to redirect users to arbitrary external websites, potentially leading to phishing attacks and credential theft. There is no indication of direct system compromise or data integrity impact from this vulnerability alone. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users and administrators should be cautious with URLs containing the return_to parameter and educate users about the risks of phishing via manipulated login URLs. Implementing web application firewall (WAF) rules to detect and block suspicious redirect parameters may help mitigate risk.