HCL AION contains an open redirect vulnerability in the GenAI web interface's user menu component. The logout redirect URL is derived from a build configuration variable without validation, which could be exploited in phishing attacks. This vulnerability has a medium severity rating and a CVSS score of 4.7.
HCL AION contains an open redirect vulnerability in the GenAI web interface's session-handling logic. The vulnerability arises from a redirect URL taken from build configuration (NEXT_PUBLIC_LOGIN_URL) that is not validated before use. This flaw can be exploited in phishing attacks, potentially causing unintended behavior or security impact under certain conditions. The vulnerability has a CVSS score of 4.7, indicating medium severity. No affected versions or patches are explicitly stated in the available data.
HCL AION contains an open redirect vulnerability in its GenAI web interface's session-handling logic. The login page redirect URL is sourced from a build configuration variable without validation, which could be exploited in phishing attacks. This vulnerability has a medium severity rating and does not currently have a known exploit in the wild. No affected versions or patches have been specified.
HCL AION contains an open redirect vulnerability in its user registration page's Signup component. The vulnerability arises because the 'redirect' query parameter is used without validation after registration, allowing attackers to craft links that redirect users to untrusted external sites. This flaw can facilitate phishing attacks by misleading users into visiting malicious websites. The vulnerability has a medium severity rating with a CVSS score of 4.7.
HCL AION contains an open redirect vulnerability in the RoleAssignPending component. The redirect URL to the login page is derived from a build configuration variable without validation, allowing potential redirection to arbitrary destinations. This flaw may be leveraged in phishing attacks, causing unintended user redirection and possible security implications under certain conditions.
HCL AION contains an open redirect vulnerability in the navigation bar of its GenAI web interface. The vulnerability arises from the 'switch-version' action redirecting users to a dynamically constructed URL without validating the destination. This flaw can be exploited in phishing attacks, potentially causing unintended security impacts under specific conditions. The vulnerability has a CVSS score of 4.7, indicating medium severity. No affected versions or patches are explicitly stated in the available data.
OpenEMR versions prior to 8.3.0 contain an open redirect vulnerability in the userSessionLogout() function of the AuthorizationController.php file. This occurs because the id_token_hint parameter is processed without signature verification, and when a trusted session is missing, the application redirects to a user-supplied post_logout_redirect_uri without validating it against registered client redirect URIs. This allows unauthenticated attackers to craft logout links that redirect users to arbitrary external sites, potentially facilitating phishing attacks. The vulnerability is fixed in OpenEMR version 8.3.0.
An Open Redirect vulnerability has been identified in OpenText™ Universal Discovery and CMDB. The vulnerability can be exploited only if an attacker sends a specially crafted URL containing a link to a malicious resource and a user subsequently follows that link.
Affected systems:
This issue affects only the classic deployment options for UCMDB UI (ucmdb-browser) component within Universal Discovery and CMDB and Operations Bridge Manager. Containerized deployment options are not affected.
IBM Db2 Genius Hub versions 1.1.2 through 1.1.5 contain an open redirect vulnerability (CWE-601) that could allow a remote authenticated attacker to conduct phishing attacks by redirecting users to malicious sites.
The Symfony HtmlSanitizer component MetaRefreshAttributeSanitizer, introduced to fix CVE-2026-48761, sanitizes the refresh URL of content attributes of meta tags using a regular expression that is too narrow, allowing sanitization to be bypassed, and resulting in potential URL redirection to untrusted sites in Symfony versions 6.1.x prior to 6.4.50, 7.x prior to 7.4.23, and 8.x prior to 8.1.11.
The shared declarative refresh steps in the WHATWG HTML Standard require a broader approach: the separator after the time may be ASCII whitespace alone, with no ; or ,, and the url= keyword is optional. Directives the browser honours, but the regular expression misses are returned unchanged, so the attacker URL skips UrlSanitizer entirely and both allowLinkSchemes and allowLinkHosts are defeated for the refresh navigation.
This is reachable under any configuration that allows meta with http-equiv and content, including the documented allowStaticElements() preset.
A vulnerability has been identified in armeria-saml versions prior to 1.41.1, where attacker-controlled RelayState is reflected into the HTTP Location header after successful authentication, allowing an unvalidated redirect to an attacker-controlled URL.
CGI versions prior to 5.00 for Perl contain an open redirect vulnerability due to improper ordering of validation and canonicalization. The redirect function decodes HTML entities in the URL after validation, allowing a validated URL to be transformed into a different URL that can redirect users to an unintended external host.
CGI versions prior to 5.00 for Perl contain an open redirect and script injection vulnerability due to unsafe construction of URLs from the client-supplied REQUEST_URI. This allows attackers to craft URLs that redirect users to malicious sites or execute scripts via protocol-relative, absolute, or javascript: URLs.
CGI versions prior to 5.00 for Perl improperly trust the client-supplied X-Forwarded-Host header when constructing URLs and redirects. This lack of validation allows an attacker to manipulate URLs used in redirects, links, and scripts, potentially poisoning shared caches and causing users to be redirected to malicious hosts.
CVE-2026-111754 is an open redirect vulnerability in Angular server-side rendering (SSR) prior to versions 20.3.33, 21.2.25, and 22.2.1. The issue arises from improper handling of protocol-relative URLs and dot segments in request paths, allowing an attacker to craft a URL that causes the SSR to emit an HTTP Location header redirecting browsers to attacker-controlled origins. This affects applications using @angular/platform-server and @angular/ssr with certain routing configurations. Pure client-side single-page applications are not affected.
A URI redirection weakness exists in the authentication component of the Atlas SQL JDBC Driver. During an interactive sign-in flow the driver accepts endpoint addresses supplied by the remote endpoint it is pointed at without validating their scheme, and passes the resulting address to the local default protocol handler. An unauthenticated remote party that controls the endpoint a user elects to connect to may cause an address of its choosing to be opened on the user's system; user interaction is required.
The click tracking middleware accepts an arbitrary target URL and redirects to it. Attackers can misuse links to the website to redirect users to external sites.
The product fails to sufficiently validate callback URLs, allowing them to be manipulated with malicious payloads when processed through a weak regular expression or when validation is omitted.
An attacker can exploit this by crafting a link that appears legitimate but redirects users to an attacker-controlled page. This redirection facilitates phishing attacks, enabling the harvesting of sensitive user information, potentially leading to unauthorized access or data theft.
The affected components accept user-supplied input for constructing redirection URLs without enforcing expected validation constraints. This allows an attacker to provide a crafted URL that can redirect users to an arbitrary external domain.
By leveraging this open redirection vulnerability, an attacker can craft a malicious link that, when clicked by a user, redirects them to an attacker-controlled page. This can be used in conjunction with social engineering techniques to execute phishing attacks, aiming to obtain sensitive information or cause other harm.
CVE-2026-118658 is an open redirect vulnerability in the labstack echo Go web framework. Versions prior to 4.15.2 and 5.1.1 allow an attacker to control the URI scheme used in redirects by manipulating certain forwarded scheme headers. This can lead to redirects to arbitrary URI schemes if an affected redirect middleware is used. The vulnerability requires user interaction and does not affect HTTPS-specific redirect variants. Fixed in versions 4.15.2 and 5.1.1.