# CVE-2025-4296: HotelRunner B2B open redirect and forceful browsing

Source: https://junglewise.ai/threats/cve-2025-4296-hotelrunner-b2b-open-redirect-and-forceful-browsing  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2025-07-23. Updated: 2026-06-05  
License: CC BY 4.0 with a link back

CVE-2025-4296 · Severity: medium · CVSS 4.7 · Published 2025-07-23

HotelRunner B2B, a platform used for business-to-business travel and hospitality management, contains a security flaw that allows attackers to redirect users to malicious websites. By tricking a user into clicking a specially crafted link, an attacker can send them to a fraudulent site that looks legitimate, potentially leading to credential theft or phishing attacks. This vulnerability undermines user trust and can be used as a starting point for more complex social engineering campaigns.

Technologies: [HotelRunner B2B](https://junglewise.ai/threats/technologies/b2b). Vendors: [HotelRunner](https://junglewise.ai/threats/vendors/hotelrunner).

## Quick answers

**Is CVE-2025-4296 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-4296 being exploited in the wild.

**How severe is CVE-2025-4296?** Medium severity, with a CVSS score of 4.7, published 23 July 2025.

**Which products and versions are affected?** HotelRunner B2B before 04.06.2025.

**Is there a fix for CVE-2025-4296?** A patch was published on 2025-06-04. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2025-4296 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2025-4296?** Check whether you run HotelRunner B2B at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An open redirect vulnerability (CWE-601) exists in HotelRunner B2B due to insufficient validation of user-supplied input used in redirection targets. A remote, unauthenticated attacker can exploit this by crafting a URL that, when visited by a legitimate user, redirects them to an arbitrary external domain. This flaw also facilitates 'forceful browsing' techniques. The vulnerability requires minimal user interaction (clicking a link) and is rated with a CVSS score of 4.7. A fix was implemented in the version released on or after June 4, 2025.

## Affected products

- HotelRunner B2B before 04.06.2025

## Timeline

- 2025-07-23: disclosed
- 2025-07-23: advisory
- 2025-06-04: patched

## References

- [https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-25-0169](https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-25-0169)
- [https://www.usom.gov.tr/bildirim/tr-25-0169](https://www.usom.gov.tr/bildirim/tr-25-0169)

## Related threats

- [HotelRunner B2B HTTP response splitting via certificate validation failure](https://junglewise.ai/threats/cve-2025-4295-hotelrunner-b2b-http-response-splitting-via-certificate-validation)
- [HotelRunner B2B Cross-Site Scripting](https://junglewise.ai/threats/cve-2025-4294-hotelrunner-b2b-cross-site-scripting)