CVE-2026-96773 describes an open redirect vulnerability in Intelliants Subrion CMS up to version 4.2.1. The vulnerability resides in the iaUsers::authorize function of the front/login.php file, specifically involving the manipulation of the $_SERVER['HTTP_REFERER'] parameter. This allows an attacker to redirect users to arbitrary external URLs. The vulnerability can be exploited remotely without authentication. Public exploit code is available, but the vendor has not issued any response or patch.

Successful exploitation of this vulnerability allows attackers to redirect users to arbitrary external websites, which can facilitate phishing attacks or redirect users to malicious sites. There is no indication of direct code execution or data compromise from this vulnerability alone.

No official fix or patch has been provided by the vendor. Users should consider implementing manual input validation or filtering on the HTTP_REFERER parameter to prevent open redirects. Monitor vendor channels for any future advisories or patches. Since the vendor has not responded, caution is advised when using affected versions.