Quick answers
- Is CVE-2026-112034 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-112034 being exploited in the wild.
- How severe is CVE-2026-112034?
- Medium severity, with a CVSS score of 4.3, published 19 October 2026.
- Which products and versions are affected?
- Aircheng-Org iWebShop-5 up to 5.16.
- Is there a fix for CVE-2026-112034?
- No fixed version is recorded yet. Implement server-side validation to reject callback parameters containing http://, https://, //, and backslash sequences; only allow relative in-app paths or use an allow-list of named routes mapped on the server side. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-112034 attacked?
- It is attacked over the network, in a web application.
- Am I affected by CVE-2026-112034?
- Check whether you run Aircheng-Org iWebShop-5 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
Implement server-side validation to reject callback parameters containing http://, https://, //, and backslash sequences; only allow relative in-app paths or use an allow-list of named routes mapped on the server side.
Technical details
The IController::redirect function in plugins/_userInfo/_userInfo.php fails to properly validate the callback parameter, allowing open redirect to arbitrary absolute URLs. An unauthenticated remote attacker can supply a malicious callback value during login; after successful authentication, the application redirects the user to the attacker's domain. No authentication is required to craft the malicious login request, only user interaction to log in.
Affected products
- aircheng-org iWebShop-5 up to 5.16
Timeline
- 2026-09-30: disclosed
- 2026-10-19: advisory