CVE-2026-86351
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N
Summary
Affected versions of MISP validate the user-configurable homepage by checking only whether the supplied path begins with /. That check is insufficient because protocol-relative URLs such as //attacker.example also begin with / but resolve to an external origin in browsers.
The vulnerable homepage value can be stored as a user setting and later used by the post-login routing logic. The commit explicitly identifies //attacker.example as a payload that passed validation and was emitted to the Location header after login.
The fix introduces a shared InternalRedirectValidator that rejects URLs containing a host, scheme, userinfo, unsafe leading // or /, malformed URLs, and control characters. It also revalidates homepage settings on read so legacy or internally written unsafe values cannot bypass the new storage-time validation.
Version affected: ≤2.5.45
Affected Software
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| MISP | MISP | 0 <= 2.5.45 | affected |
Weaknesses
- CWE-601: CWE-601 URL Redirection to Untrusted Site ('Open Redirect')
- CWE-20: CWE-20 Improper Input Validation
References
Feedback
Was this page helpful?
Glad to hear it! Please tell us how we can improve.
Sorry to hear that. Please tell us how we can improve.