Threats Tagged 'cwe-601'

Insufficient validation in the Single Sign-On (SSO) login flow could allow a remote, unauthenticated attacker to craft a URL that, when clicked by a user, causes the identity provider (IdP) to deliver authentication material to an attacker-controlled URL instead of to CloudVision.

CVE-2026-101151 is an open redirect vulnerability in Arista Networks CloudVision Portal. It arises from insufficient validation of URLs in the login flow, allowing a remote unauthenticated attacker to craft a URL that redirects users to arbitrary external sites after authentication. This could potentially be used in phishing or social engineering attacks. The vulnerability has a medium severity with a CVSS score of 4.3.

### Impact Under certain conditions, an attacker can craft a redirect link that sends a guest user to an untrusted destination after authenticating. ### Patches Users should upgrade Payload packages to `>= 3.88.0` or `>= 4.0.0-canary.27`. ### Workarounds Upgrading is recommended. Until then, remove user-controlled redirect values from authentication flows or restrict them to known local paths.

An open redirect vulnerability exists in the PingGateway Fragment Filter feature. This issue affects PingGateway versions 7.1.0 and later, 2023.2.0 through 2024.11.1, and 2025.3.0 through 2025.11.1. It is fixed in versions 2024.11.2, 2025.11.2, and 2026.3.0 (and later).

Joomla Extension - svenbluege.de - Cross-site scripting and open redirect on the share mini page in Event Gallery extension < 6.6.0 - The page a shared image link opens (the share mini page of the front end) can link the article the image was shared from when the option "Share article links" is on. It took the address of the article from the shared link and printed it into the page without checking or escaping it; with the link type "Image Page with Redirect" it followed the address at once. A prepared link could therefore run a script in the page, in the session of the visitor who opened it, or send the visitor to another web site. Nothing on the server is changed or read by the server.

A URL Redirection to Untrusted Site ('Open Redirect') vulnerability exists in Mehul Gohil Aculect AI Companion (aculect-ai-companion) versions up to 0.8.1. This vulnerability can be leveraged for phishing attacks by redirecting users to malicious sites. The vulnerability has a medium severity with a CVSS score of 4.7. No official patch or remediation information is currently provided.

The Giveaways and Contests by RafflePress WordPress plugin before 1.12.27 does not properly validate a giveaway's parent page URL before saving it and later redirecting visitors to it, allowing unauthenticated attackers to make the site's own giveaway confirmation and referral links redirect visitors to an arbitrary external site.

OpenRun versions prior to 0.17.7 contain an open redirect vulnerability (CVE-2026-55252) due to improper validation of redirect URLs. The validation logic checks that the host and schema match the current site, but fails to handle URLs with double slashes in the path (e.g., //host), allowing attackers to bypass restrictions and redirect users to external sites. This vulnerability can be exploited by crafting URLs that appear local but cause browsers to redirect to malicious external domains.

Kiteworks Core before version 9.5.1 is vulnerable to Content Injection. A URL parameter in the PDF viewer was insufficiently validated, allowing an attacker-controlled document to be loaded and displayed under the trust of the legitimate application domain. This could increase the credibility of phishing attempts relying on malicious links embedded in the displayed content.

The Safe Redirect Manager WordPress plugin before 2.3.0 does not properly validate the redirect destination when a wildcard redirect rule to an absolute URL is configured, allowing unauthenticated attackers to redirect visitors to an arbitrary external website via a crafted request path.