Kyoo is a self-hosted media server focused on movies, series, and anime. Prior to 5.1.0, an unauthenticated attacker could initiate the OIDC login flow with an attacker-controlled redirectUrl. The login handling in auth/oidc.go stored that URL with the opaque login state, and /auth/oidc/logged/{provider} appended the provider, token, and error values before redirecting the victim's browser without validating the destination. Because the one-use token was not bound to the browser session that initiated login, an attacker who induced a victim to complete OIDC authentication could capture the token at the attacker-controlled destination and exchange it through /auth/oidc/callback/{provider} for the victim's Kyoo session. This issue is fixed in version 5.1.0.
Obsidian Web MCP is a secure remote MCP server for Obsidian vaults. Prior to 0.2.0, /oauth/authorize issues an authorization code without a login, consent, or session check, and /oauth/token can exchange that code for the static VAULT_MCP_TOKEN without authenticating a client. An unauthenticated remote caller who can reach the intended tunnel deployment can therefore call /mcp and use vault_read, vault_write, vault_search, vault_list, vault_move, and vault_delete against the entire vault. Optional PKCE does not prevent an attacker-initiated flow, and unauthenticated /oauth/register also exposes a client_credentials path by returning the configured VAULT_OAUTH_CLIENT_SECRET. This issue is fixed in version 0.2.0.
CVE-2026-86823 is an open redirect vulnerability in the Newsletter WordPress plugin versions before 9.3.7. The plugin does not validate the destination URL after a public subscription action, allowing unauthenticated attackers to redirect users to arbitrary external sites. This flaw also exposes a subscriber token that can be used to access subscriber front-end actions. The vulnerability has a medium severity rating with a CVSS score of 5.3.
Kiwi TCMS versions prior to 16.1 contain an open redirect vulnerability in the account confirmation endpoint. This flaw allows unauthenticated attackers to craft URLs on trusted Kiwi TCMS domains that redirect users to arbitrary external sites. Such redirects can be exploited for credential harvesting, bypassing email security filters, or delivering malware via deceptive account confirmation links. The vulnerability is resolved in version 16.1.
The "Firma Circolare" feature in the "Design Scuole Italia" WordPress theme allows an authenticated attacker to inject arbitrary HTML via the sign parameter, enabling forced redirection of visiting users to an attacker-controlled URL (Stored HTML Injection / Open Redirect).
IBM Verify Identity Access could allow a remote attacker to conduct phishing attacks, using an open redirect attack. By persuading a victim to visit a specially crafted Web site, a remote attacker could exploit this vulnerability to spoof the URL displayed to redirect a user to a malicious Web site that would appear to be trusted. This could allow the attacker to obtain highly sensitive information or conduct further attacks against the victim.
CVE-2026-15412 is an open redirect vulnerability in IBM WebSphere Application Server versions 8.5, 9.0, and Liberty 17.0.0.3 through 26.0.0.5. This flaw allows remote attackers to craft URLs that redirect users to malicious websites, potentially enabling phishing attacks by spoofing trusted URLs. The vulnerability could lead to unauthorized disclosure of sensitive information or facilitate further attacks on victims.
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Apache Syncope.
When the Syncope SRA is configured for CAS authentication, the target Apereo CAS instance's URL is calculated by unconditionally looking at client-supplied forwarded HTTP headers.
This issue affects Apache Syncope: from 3.0.0-M0 through 3.0.16, from 4.0.0-M0 Through 4.0.7, from 4.1.0-M0 through 4.1.2.
Users are recommended to upgrade to version 4.0.8 / 4.1.3, which fix this issue.
The User Registration & Membership WordPress plugin before 5.2.8 does not validate the destination of a post-login redirect before redirecting, allowing unauthenticated attackers to redirect visitors to an arbitrary external URL, which can be abused for phishing.
A file-upload handler redirects the authenticated client's browser to a URL taken directly from that same request's Referer header, without validating it against the application's own origin. This allows an authenticated attacker to craft a request that causes another user's browser to be redirected to an arbitrary external destination after completing an upload.
Authorizer versions prior to 2.2.1 have an open redirect vulnerability in the /authorize endpoint. This endpoint does not validate the redirect_uri parameter against allowed origins, allowing an attacker to redirect users to arbitrary URLs with appended tokens. The vulnerability was partially addressed in version 2.0.1 for other endpoints but not /authorize. Version 2.2.1 contains a complete fix.
CVE-2026-8323 is a critical open redirect vulnerability in Armiya Information Technologies Ltd. Co.'s Access Control System versions before Versiyon 2. This flaw allows attackers to redirect users to untrusted sites, potentially enabling phishing or other malicious activities by faking the source of data. The vulnerability has a high CVSS score of 9.3, indicating significant confidentiality and integrity impact without availability loss. A fix is available in Versiyon 2.
CVE-2026-78377 is an open redirect vulnerability in Yordam Informatics Technology's Library Information and Document Automation Program versions from 22.1 up to but not including 22.2. This flaw allows attackers to redirect users to untrusted external sites, facilitating phishing attacks. The vulnerability has a medium severity rating with a CVSS score of 6.1. A fix is available in version 22.2.
The Groundhogg — CRM, Newsletters, and Marketing Automation WordPress plugin before 4.7.2 does not restrict the redirect target of its email preference confirmation flow to the site's own host, allowing unauthenticated attackers to redirect visitors to an arbitrary external URL by way of a crafted link.
CVE-2026-84282 is a Server-Side Request Forgery (SSRF) vulnerability in the ONLYOFFICE ownCloud Integration plugin version 9.12. It occurs because the /apps/onlyoffice/ajax/settings/address endpoint does not properly validate the Document Server URL provided by an authenticated administrator. This flaw allows the ownCloud server to send arbitrary requests to attacker-controlled destinations, including internal network hosts, enabling internal network reconnaissance and TCP port scanning.
The Accept Stripe Payments WordPress plugin before 2.1.4 does not validate a user-supplied URL before using it in a redirect, allowing unauthenticated attackers to redirect visitors to an arbitrary external website, which can be leveraged for phishing.
Waku is the minimal React framework. Prior to version 1.0.0-beta.1, the unstable_redirect() helper exported from waku/router/server (packages/waku/src/router/define-router.tsx:156–161) accepts an arbitrary string and reflects it unchanged into the HTTP Location response header with no URL validation, scheme restriction, or path-only enforcement. Any application that passes user-controlled input to this helper — the natural pattern documented in the JSDoc and official fixtures — is vulnerable to open redirect attacks. An attacker who convinces a victim to click a crafted link can silently redirect the browser to an arbitrary external domain, enabling phishing, credential harvesting, and OAuth token theft. Additionally, scheme-relative URLs (//evil.example/) bypass naive https?://-only allow-list filters that developers might add as ad-hoc mitigations. This issue has been patched in version 1.0.0-beta.1.