CVE-2026-10839
Description
Open redirection vulnerability in the authentication system allows an attacker to use manipulated values in the X-Forwarded-Host header to alter the URLs generated by the application. A successful exploit could redirect authenticated users to malicious sites following login procedures or interaction with the interface, resulting in limited impact on confidentiality and integrity.
Summary dbcve.org
Open redirection vulnerability in the authentication system where the application trusts and uses the X-Forwarded-Host HTTP header to generate redirect URLs without proper validation. Attackers can manipulate this header to cause authenticated users to be redirected to attacker-controlled malicious sites after login or during interface interactions.
Mitigation
Implement strict allowlist validation for X-Forwarded-Host header values against trusted domains, or remove reliance on this header for redirect URL generation and use only internally-defined trusted domains.