Thelia v2.6.0 contains an open redirect vulnerability in its address creation workflow. (CVE-2026-103523)

The vulnerability in Thelia v2.6.0 involves an open redirect in the address creation workflow. Specifically, after a user accesses a crafted URL and submits the 'Add New Address' form, the application redirects the user to the URL provided in the 'next' parameter. The application fails to validate whether this URL belongs to the same origin or an approved allowlist, enabling attackers to supply arbitrary external URLs and redirect users to attacker-controlled sites.

Users of Thelia v2.6.0 can be redirected to malicious external websites controlled by attackers after submitting the address creation form. This can facilitate phishing attacks or other social engineering exploits by leveraging the trusted context of the original site. There is no indication of direct code execution or data compromise from this vulnerability alone.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should be cautious about URLs containing 'next' parameters and avoid clicking suspicious links that lead to the address creation workflow. Vendors and administrators should monitor for official patches or updates addressing this issue.