CVE-2026-10861
- Source
- https://cve.org/CVERecord?id=CVE-2026-10861
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-10861.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2026-10861
- Published
- 2026-06-04T13:26:05Z
- Modified
- 2026-10-28T02:31:13Z
- Severity
-
- 5.1 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N/U:Green CVSS Calculator
- Summary
- MISP post-login open redirect via pre_login_requested_url
- Details
-
An open redirect vulnerability existed in MISP UsersController::routeafterlogin() because the value stored in the pre_login_requested_url session key was used as the post-login redirect destination without sufficiently enforcing that it was a local application path.
An unauthenticated remote attacker could craft a link that causes a victim to visit a trusted MISP instance and, after successful authentication, be redirected to an attacker-controlled external URL. This could be abused to increase the credibility of phishing attacks, redirect users to counterfeit login pages, or deliver attacker-controlled content from an untrusted domain. CWE-601 describes this weakness as accepting user-controlled input that specifies an external link and using it in a redirect, with phishing as a common consequence.
The patch mitigates the issue by decoding and parsing the URL, rejecting URLs with a scheme, host, user component, missing or non-local path, and protocol-relative forms such as //example.com and /\example.com.
- Database specific
{ "cna_assigner": "CIRCL", "cwe_ids": [ "CWE-601" ], "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/10xxx/CVE-2026-10861.json" }- References
Affected packages
Git / github.com/misp/misp
Affected ranges
- Type
- GIT
- Repo
- https://github.com/misp/misp
- Events
-
Introduced0 Unknown introduced commit / All previous commits are affectedFixedFixed
- Database specific
-
Show details
{ "extracted_events": [ { "cpe": "cpe:2.3:a:misp-project:misp:*:*:*:*:*:*:*:*", "range": [ { "introduced": "0" }, { "fixed": "2.5.39" } ], "source": "CPE_RANGE" }, { "range": [ { "fixed": "ae760b7bf534f2798810d59a1f961b31adb3443e" } ], "source": "REFERENCES_COMMIT" } ] }