CVE-2026-100523

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-100523
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-100523.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-100523
Published
2026-09-26T00:59:24Z
Modified
2026-09-27T03:47:23Z
Severity
  • 5.1 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N CVSS Calculator
Summary
Cotonti through 1.0.0 Open Redirect via message.php redirect parameter
Details

Cotonti through 1.0.0 contains an open redirect vulnerability in message.php that base64-decodes the redirect parameter without domain validation. Unauthenticated attackers can craft malicious links with encoded external URLs to redirect users to arbitrary sites via meta refresh tags for phishing attacks.

Database specific 
{
    "cna_assigner":  "VulnCheck",
    "cwe_ids":  [
        "CWE-601"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/100xxx/CVE-2026-100523.json"
}
References

Affected packages

Git / github.com/cotonti/cotonti

Affected ranges

Type
GIT
Repo
https://github.com/cotonti/cotonti
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
0d554e939a315e7f7f18fba3ca1132b80c6a1adb
Database specific
Show details 
{
    "extracted_events":  [
        {
            "introduced":  "0"
        },
        {
            "last_affected":  "1.0.0"
        },
        {
            "fixed":  "1.0.0"
        }
    ],
    "source":  [
        "AFFECTED_FIELD",
        "DESCRIPTION"
    ]
}

Affected versions

0.*
0.9.12
0.9.12.1
0.9.13
0.9.14
0.9.15
0.9.16
0.9.16.1
0.9.16.2
0.9.17
0.9.18
0.9.18.1
0.9.19
0.9.19-RC.1
0.9.19-rc1
0.9.20
0.9.20.1
0.9.21
0.9.22
0.9.23
0.9.24
0.9.24.1
0.9.24.2
0.9.25
cotonti-0.*
cotonti-0.9.10
cotonti-0.9.11
cotonti-0.9.11.1
cotonti-0.9.3
cotonti-0.9.6
cotonti-0.9.7
cotonti-0.9.8

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-100523.json"