{"api_version":"1","generated_at":"2026-11-13T09:59:23+00:00","cve":"CVE-2026-128637","urls":{"html":"https://cve.report/CVE-2026-128637","api":"https://cve.report/api/cve/CVE-2026-128637.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2026-128637","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-128637"},"summary":{"title":"Open Redirect in MISP Modules Website Login via Unvalidated next Parameter","description":"The MISP Modules website component contains an open redirect vulnerability in its login endpoint. The /login route accepted a user-supplied next query parameter and passed it directly to Flask's redirect() function without validating the destination. An attacker could craft a URL such as https://victim-host/login?next=https://attacker.example/phish and deliver it to a user (e.g., via email or a lookalike page). After the user successfully authenticated, the application issued a 302 redirect to the attacker-controlled external URL. This enables phishing attacks where a user, believing they are still on the legitimate MISP Modules site, may enter additional credentials or sensitive information on the attacker's page. It can also be used to obscure the true destination of a link, bypassing user trust in the legitimate domain. The vulnerability requires the victim to interact with the crafted URL and complete a login, but no prior authentication or special configuration is needed on the attacker's side. The affected component is the website sub-project of misp-modules, specifically the account blueprint in website/app/account/account.py. No version boundaries are specified in the patch metadata.","state":"PUBLISHED","assigner":"CIRCL","published_at":"2026-11-13 08:17:17","updated_at":"2026-11-13 08:17:17"},"problem_types":["CWE-601","CWE-601 CWE-601 Open Redirect"],"metrics":[{"version":"4.0","source":"5a6e4751-2f3f-4070-9419-94fb35b644e8","type":"Secondary","score":"5.1","severity":"MEDIUM","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","data":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.1,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"ACTIVE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}},{"version":"4.0","source":"CNA","type":"CVSS","score":"5.1","severity":"MEDIUM","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N","data":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","baseScore":5.1,"baseSeverity":"MEDIUM","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","subIntegrityImpact":"NONE","userInteraction":"ACTIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"}}],"references":[{"url":"https://github.com/MISP/misp-modules/commit/d115f00414e761b0b70c8c8671edac681de74a4c","name":"https://github.com/MISP/misp-modules/commit/d115f00414e761b0b70c8c8671edac681de74a4c","refsource":"5a6e4751-2f3f-4070-9419-94fb35b644e8","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-128637","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-128637","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"misp","product":"misp-modules","version":"affected 3.1.4 semver","platforms":[]}],"timeline":[],"solutions":[{"source":"CNA","title":"","value":"The fix introduces a _safe_next_url() validation function that restricts post-login redirect destinations to local paths or same-host HTTP(S) URLs. Any target that is empty, contains backslashes, control characters, leading/trailing whitespace, an unrecognized scheme, a mismatched host, or a protocol-relative form is rejected and the user is redirected to the home page (/). Accepted same-host URLs are normalized to local paths (scheme and authority stripped) while preserving query strings and fragments, ensuring the Location header always contains a relative path. This eliminates the ability to redirect users to arbitrary external destinations after authentication.","time":"","lang":"en"}],"workarounds":[],"exploits":[],"credits":[{"source":"CNA","value":"Alexandre Dulaunoy","lang":"en"}],"nvd_cpes":[],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"cna":{"affected":[{"cpes":["cpe:2.3:a:misp:misp-modules:*:*:*:*:*:*:*:*"],"modules":["website"],"product":"misp-modules","programFiles":["website/app/account/account.py"],"repo":"https://github.com/MISP/misp-modules","vendor":"misp","versions":[{"lessThanOrEqual":"3.1.4","status":"affected","version":"0","versionType":"semver"}]}],"cpeApplicability":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:misp:misp-modules:*:*:*:*:*:*:*:*","versionEndIncluding":"3.1.4","versionStartIncluding":"0","vulnerable":true}],"negate":false,"operator":"OR"}]}],"credits":[{"lang":"en","type":"remediation developer","value":"Alexandre Dulaunoy"}],"descriptions":[{"lang":"en","value":"The MISP Modules website component contains an open redirect vulnerability in its login endpoint. The /login route accepted a user-supplied next query parameter and passed it directly to Flask's redirect() function without validating the destination. An attacker could craft a URL such as https://victim-host/login?next=https://attacker.example/phish and deliver it to a user (e.g., via email or a lookalike page). After the user successfully authenticated, the application issued a 302 redirect to the attacker-controlled external URL. This enables phishing attacks where a user, believing they are still on the legitimate MISP Modules site, may enter additional credentials or sensitive information on the attacker's page. It can also be used to obscure the true destination of a link, bypassing user trust in the legitimate domain. The vulnerability requires the victim to interact with the crafted URL and complete a login, but no prior authentication or special configuration is needed on the attacker's side. The affected component is the website sub-project of misp-modules, specifically the account blueprint in website/app/account/account.py. No version boundaries are specified in the patch metadata."}],"impacts":[{"capecId":"CAPEC-113","descriptions":[{"lang":"en","value":"CAPEC-113 Open Redirect"}]}],"metrics":[{"cvssV4_0":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","baseScore":5.1,"baseSeverity":"MEDIUM","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","subIntegrityImpact":"NONE","userInteraction":"ACTIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]},{"format":"SSVC","other":{"content":{"options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"role":"Supplier","timestamp":"2026-11-13T07:10:51Z","version":"2.0.3"},"type":"SSVC"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-601","description":"CWE-601 Open Redirect","lang":"en","type":"CWE"}]}],"providerMetadata":{"dateUpdated":"2026-11-13T07:15:18.086Z","orgId":"5a6e4751-2f3f-4070-9419-94fb35b644e8","shortName":"CIRCL"},"references":[{"name":"Security patch","tags":["patch"],"url":"https://github.com/MISP/misp-modules/commit/d115f00414e761b0b70c8c8671edac681de74a4c"}],"solutions":[{"lang":"en","value":"The fix introduces a _safe_next_url() validation function that restricts post-login redirect destinations to local paths or same-host HTTP(S) URLs. Any target that is empty, contains backslashes, control characters, leading/trailing whitespace, an unrecognized scheme, a mismatched host, or a protocol-relative form is rejected and the user is redirected to the home page (/). Accepted same-host URLs are normalized to local paths (scheme and authority stripped) while preserving query strings and fragments, ensuring the Location header always contains a relative path. This eliminates the ability to redirect users to arbitrary external destinations after authentication."}],"title":"Open Redirect in MISP Modules Website Login via Unvalidated next Parameter","x_gcve":[{"extensions":{"bcp-05-x-01":{"ai_annotations":[{"ai_level":"generated","description":"Draft vulnerability metadata was generated from a git-format patch using an Ollama-hosted language model. Human validation is required before publication.","gna_source":1,"models":[{"gna_source":1,"identifier":"qwen3.8:27b","name":"qwen3.8:27b","source":"ollama"}],"review_status":"full","scope":"record","tags":["ai-computer-assisted:llm-generated","ai-computer-assisted:classification"]}]},"bcp-05-x-02":{"x_patch2vuln":{"assumptions":["No specific affected or fixed version is identified in the patch metadata; the version range is recorded as unspecified.","The CVSS UI metric is set to Active (A) on the assumption that the victim must click a crafted link and submit login credentials; if the login page is auto-submitted in a phishing context, UI could be argued as Passive, but the evidence supports Active.","SC is set to Low based on the phishing/social-engineering risk of redirecting a user to an external site after login; no direct data exfiltration mechanism is present in the vulnerable code path.","The CAPEC-113 mapping is the closest available pattern for open redirect; no more specific CAPEC exists for post-login redirect manipulation.","The patch does not indicate whether this vulnerability was reported through a coordinated disclosure process; no finder or reporter credit is assigned beyond the remediation developer.","The website component is assumed to be a Flask-based web application served over HTTP(S); the patch does not specify deployment topology or additional authentication layers."],"capecRationale":[{"capecId":"CAPEC-113","rationale":"The patch directly addresses an open redirect: an attacker crafts a login URL with a malicious next parameter to redirect the victim to an external phishing site after authentication. CAPEC-113 describes exactly this attack pattern where a web application redirects to a user-controlled destination without proper validation. This is the closest and most precise CAPEC mapping available for this vulnerability class."}],"commit":"d115f00414e761b0b70c8c8671edac681de74a4c","confidence":"high","credits":[{"lang":"en","type":"remediation developer","value":"Alexandre Dulaunoy"}],"cvssRationale":"AV:N: exploitable over the network via a crafted URL. AC:L: no race conditions or special conditions; simply append a next parameter. AT:N: no attack requirements beyond delivering the URL. PR:N: the attacker needs no account; the victim performs the login. UI:A: the victim must actively visit the crafted URL and submit credentials. VC/VI/VA:N: the vulnerable system itself suffers no direct confidentiality, integrity, or availability loss. SC:L: subsequent confidentiality impact is low because the redirected user may be tricked into entering sensitive data on a phishing page, but the session cookie is domain-scoped and not directly exfiltrated. SI/SA:N: no subsequent integrity or availability impact is evidenced.","draft":false,"fixSummary":"The fix introduces a _safe_next_url() validation function that restricts post-login redirect destinations to local paths or same-host HTTP(S) URLs. Any target that is empty, contains backslashes, control characters, leading/trailing whitespace, an unrecognized scheme, a mismatched host, or a protocol-relative form is rejected and the user is redirected to the home page (/). Accepted same-host URLs are normalized to local paths (scheme and authority stripped) while preserving query strings and fragments, ensuring the Location header always contains a relative path. This eliminates the ability to redirect users to arbitrary external destinations after authentication.","generatedAt":"2026-11-13T07:10:51.231558Z","generator":"patch2vuln.py","model":"qwen3.8:27b","modelComparison":{"potentialErrors":[],"rankings":[{"agreementScore":11,"assumptionCount":6,"confidence":"high","model":"qwen3.8:27b","score":7}],"selectedModel":"qwen3.8:27b","selectionMethod":"deterministic-consensus-v1","selectionNotice":"The selected result is closest to model consensus; this heuristic does not establish factual correctness and human review remains required."},"patchSha256":"4b395e050af927c4d1a6033230f563b7d397ebcadcd72e6a56d7e61428aa31ea","patchSummary":"In website/app/account/account.py, the import of urlsplit and urlunsplit from urllib.parse is added. A new _safe_next_url() function is defined that validates the target string against a series of safety checks (whitespace, backslashes, control characters, scheme allowlist, host match, protocol-relative rejection, double-slash path rejection) and returns either a normalized local path or the fallback '/'. The login() handler's redirect call is changed from redirect(request.args.get('next') or '/') to redirect(_safe_next_url(request.args.get('next'))). A new test file website/tests/login_checks.py (172 lines) is added with comprehensive unit tests covering external rejection, malformed input rejection, local path preservation, same-host-with-port normalization, wrong-password non-redirect, CSRF enforcement, and remember-me cookie preservation. The website README is updated to document the new redirect validation behavior.","patchTruncated":false,"patches":[{"commit":"d115f00414e761b0b70c8c8671edac681de74a4c","date":"Fri, 13 Nov 2026 06:49:26 +0100","patchSha256":"4b395e050af927c4d1a6033230f563b7d397ebcadcd72e6a56d7e61428aa31ea","retrievedAt":"2026-11-13T07:10:04.602453Z","source":"https://github.com/MISP/misp-modules/commit/d115f00414e761b0b70c8c8671edac681de74a4c.patch","sourceUrl":"https://github.com/MISP/misp-modules/commit/d115f00414e761b0b70c8c8671edac681de74a4c.patch","subject":"fix: [website] restrict post-login redirects to local paths"}],"source":"https://github.com/MISP/misp-modules/commit/d115f00414e761b0b70c8c8671edac681de74a4c.patch","ssvc":{"options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"role":"Supplier","timestamp":"2026-11-13T07:10:51Z","version":"2.0.3"},"subject":"fix: [website] restrict post-login redirects to local paths","weaknessRationale":[{"cweId":"CWE-601","rationale":"The login endpoint accepted an unvalidated user-supplied URL in the next query parameter and used it directly as the redirect destination, allowing an attacker to redirect authenticated users to arbitrary external sites. This is a textbook open redirect (CWE-601)."}]}},"bcp-05-x-03":{"x_timeline":{"events":[{"description":"Corrective change authored (d115f00414e761b0b70c8c8671edac681de74a4c): fix: [website] restrict post-login redirects to local paths","id":"evt-fix-developed-1","references":["https://github.com/MISP/misp-modules/commit/d115f00414e761b0b70c8c8671edac681de74a4c.patch"],"timestamp":"2026-11-13T05:49:26Z","type":"fix-developed"},{"description":"Patch retrieved from the supplied URL; retrieval time is used as the default availability time.","id":"evt-fix-available-1","references":["https://github.com/MISP/misp-modules/commit/d115f00414e761b0b70c8c8671edac681de74a4c.patch"],"timestamp":"2026-11-13T07:10:04.602453Z","type":"fix-available"}]}}},"recordType":"advisory","vulnId":"gcve-1-2026-20325"}]}},"cveMetadata":{"assignerOrgId":"5a6e4751-2f3f-4070-9419-94fb35b644e8","assignerShortName":"CIRCL","cveId":"CVE-2026-128637","datePublished":"2026-11-13T07:15:18.086Z","dateReserved":"2026-11-13T07:15:13.649Z","dateUpdated":"2026-11-13T07:15:18.086Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-11-13 08:17:17","lastModifiedDate":"2026-11-13 08:17:17","problem_types":["CWE-601","CWE-601 CWE-601 Open Redirect"],"metrics":{"cvssMetricV40":[{"source":"5a6e4751-2f3f-4070-9419-94fb35b644e8","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.1,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"ACTIVE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"5a6e4751-2f3f-4070-9419-94fb35b644e8","ssvcData":{"timestamp":"2026-11-13T07:10:51Z","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"Supplier","version":"2.0.3"}}]},"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"128637","Ordinal":"1","Title":"Open Redirect in MISP Modules Website Login via Unvalidated next","CVE":"CVE-2026-128637","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"128637","Ordinal":"1","NoteData":"The MISP Modules website component contains an open redirect vulnerability in its login endpoint. The /login route accepted a user-supplied next query parameter and passed it directly to Flask's redirect() function without validating the destination. An attacker could craft a URL such as https://victim-host/login?next=https://attacker.example/phish and deliver it to a user (e.g., via email or a lookalike page). After the user successfully authenticated, the application issued a 302 redirect to the attacker-controlled external URL. This enables phishing attacks where a user, believing they are still on the legitimate MISP Modules site, may enter additional credentials or sensitive information on the attacker's page. It can also be used to obscure the true destination of a link, bypassing user trust in the legitimate domain. The vulnerability requires the victim to interact with the crafted URL and complete a login, but no prior authentication or special configuration is needed on the attacker's side. The affected component is the website sub-project of misp-modules, specifically the account blueprint in website/app/account/account.py. No version boundaries are specified in the patch metadata.","Type":"Description","Title":"Open Redirect in MISP Modules Website Login via Unvalidated next"}]}}}