CVE-2026-55840

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-55840

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-55840.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-55840

Aliases

GHSA-85fm-6f2v-74pq

Published

2026-10-15T18:31:57Z

Modified

2026-10-17T07:06:52Z

Severity

5.4 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N CVSS Calculator

Summary

Scoold: Open Redirect in getBackToUrl() allows phishing via domain-prefix startsWith bypass

Details

Scoold is a Q&A and a knowledge sharing platform for teams. Prior to 1.69.1, the getBackToUrl() method in src/main/java/com/erudika/scoold/utils/HttpUtils.java validates the backto and returnto parameters with Strings.CI.startsWith against the configured server URL. An attacker can supply an absolute URL whose hostname begins with the legitimate hostname, causing URI.resolve() to retain the attacker URL and the prefix check to accept it. A victim who follows the crafted sign-in link can be redirected to an attacker-controlled domain after authentication, enabling phishing and possible credential or token theft. This issue is fixed in version 1.69.1.

Database specific

{
    "cna_assigner":  "GitHub_M",
    "cwe_ids":  [
        "CWE-601"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/55xxx/CVE-2026-55840.json"
}

References

Affected packages

Git / github.com/erudika/scoold

Affected ranges

Type

GIT

Repo

https://github.com/erudika/scoold

Events

Introduced

Fixed

9d61f6fe15d4f9f6262812ba7fea43be8d5bb745

Fixed

f6d2be9995df28c0776f477f124e827fc537058e

Database specific

Show details

{
    "extracted_events":  [
        {
            "introduced":  "0"
        },
        {
            "fixed":  "1.69.1"
        }
    ],
    "source":  [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

1.*

1.24.1

1.24.10

1.24.11

1.24.2

1.24.3

1.24.4

1.24.5

1.24.6

1.24.7

1.24.8

1.24.9

1.25.0

1.25.1

1.25.2

1.25.3

1.25.4

1.25.5

1.26.0

1.26.1

1.28.0

1.28.1

1.28.10

1.28.2

1.28.3

1.28.4

1.28.5

1.28.6

1.28.7

1.28.8

1.28.9

1.29.0

1.29.1

1.29.2

1.29.3

1.29.4

1.30.0

1.30.1

1.30.2

1.30.3

1.30.4

1.30.5

1.31.0

1.31.1

1.31.2

1.31.3

1.31.4

1.32.0

1.32.1

1.33.0

1.33.1

1.34.0

1.35.0

1.35.1

1.35.2

1.35.3

1.36.0

1.36.1

1.36.2

1.37.0

1.37.1

1.38.0

1.39.0

1.39.1

1.39.2

1.39.3

1.39.4

1.40.0

1.40.1

1.40.2

1.40.3

1.40.4

1.40.5

1.41.0

1.41.1

1.41.2

1.42.1

1.43.0

1.43.1

1.43.2

1.43.3

1.44.0

1.45.0

1.46.0

1.46.1

1.46.2

1.46.3

1.48.0

1.48.1

1.48.2

1.49.0

1.49.1

1.49.2

1.49.3

1.49.4

1.49.5

1.49.6

1.49.7

1.50.0

1.50.1

1.50.2

1.50.3

1.50.4

1.50.5

1.51.0

1.51.1

1.51.2

1.51.3

1.52.0

1.52.1

1.52.2

1.52.3

1.53.0

1.54.0

1.54.1

1.55.0

1.56.0

1.56.1

1.57.0

1.57.1

1.57.2

1.57.3

1.57.4

1.57.5

1.58.0

1.58.1

1.59.0

1.60.0

1.61.0

1.62.0

1.63.0

1.64.0

1.64.2

1.64.3

1.64.4

1.64.5

1.65.0

1.66.0

1.66.1

1.66.2

1.67.0

1.67.1

1.68.0

1.68.1

1.68.2

1.69.0

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-55840.json"

vanir_signatures

[
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "220684788828629625732367091699848441508",
                "131021723977090945762313539776284731962",
                "136410206855584695551445515013100983066",
                "159901925691067072096000562230916803060",
                "37591682823241927912430738559654281199",
                "116315041618051560683774610659691865873",
                "188233671625507952932718695941899414440",
                "320493916088250238063935125873234472820",
                "268686252550637875460814217459439113827",
                "17367318795335931587668751511799176053",
                "171749738566924091445737305976609703451",
                "240921224697114157240324807564263097669",
                "33066393353862755726538922170459907876",
                "171506320655827694776529261714958924669",
                "90552005869860855663905073651469464080",
                "193863243647509895246291606458987916232",
                "126027118709588337557791947735470354293"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-55840-b1469090",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/erudika/scoold/commit/9d61f6fe15d4f9f6262812ba7fea43be8d5bb745",
        "target":  {
            "file":  "src/main/java/com/erudika/scoold/utils/HttpUtils.java"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "229414229777817657355423802354333233574",
            "length":  792
        },
        "id":  "CVE-2026-55840-ce537f80",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/erudika/scoold/commit/9d61f6fe15d4f9f6262812ba7fea43be8d5bb745",
        "target":  {
            "file":  "src/main/java/com/erudika/scoold/utils/HttpUtils.java",
            "function":  "getBackToUrl"
        }
    }
]

vanir_signatures_modified

"2026-10-17T07:06:52Z"