CVE-2026-55840: CWE-601: URL Redirection to Untrusted Site ('Open Redirect') in Erudika scoold

Erudika scoold versions before 1.69.1 contain an open redirect vulnerability (CWE-601) in the getBackToUrl() method. The method validates 'backto' and 'returnto' URL parameters by checking if they start with the configured server URL using a case-insensitive prefix check. However, an attacker can supply an absolute URL whose hostname begins with the legitimate hostname, bypassing the prefix check due to how URI.resolve() processes the URL. This allows redirection to an attacker-controlled domain after user authentication, enabling phishing and potential credential or token theft. The vulnerability is resolved in version 1.69.1.

Successful exploitation allows attackers to redirect authenticated users to attacker-controlled domains, facilitating phishing attacks and possible theft of credentials or authentication tokens. The vulnerability does not directly allow system compromise but can lead to user credential compromise.

Upgrade Erudika scoold to version 1.69.1 or later, where this open redirect vulnerability is fixed. No other mitigations are indicated by the vendor advisory.