Is CVE-2026-12379 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-12379 being exploited in the wild.

How severe is CVE-2026-12379?

Informational severity, with a CVSS score of 6.8, published 16 July 2026.

Which products and versions are affected?

Qt Group Axivion Dashboard 7.8.0 to 7.8.12, 7.9.0 to 7.9.12, 7.10.0 to 7.10.10, 7.11.0 to 7.11.6, 7.12.0 to 7.12.1.

Is there a fix for CVE-2026-12379?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-12379 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-12379?

Check whether you run Qt Group Axivion Dashboard at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-12379: Qt Axivion Dashboard open redirect in OAuth/OIDC implementation

CVE-2026-12379 · Severity: info · CVSS 6.8 · Published 2026-07-16

The Axivion Dashboard, a tool used for software analysis and quality monitoring, contains a flaw in its login process. An attacker can create a malicious link that appears to point to the legitimate dashboard but redirects the user to a fraudulent website after they log in. This can be used in phishing campaigns to trick employees into revealing their credentials or security codes to an attacker-controlled site.

Vendors: Qt Group.

Quick answers

Is CVE-2026-12379 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-12379 being exploited in the wild.
How severe is CVE-2026-12379?: Informational severity, with a CVSS score of 6.8, published 16 July 2026.
Which products and versions are affected?: Qt Group Axivion Dashboard 7.8.0 to 7.8.12, 7.9.0 to 7.9.12, 7.10.0 to 7.10.10, 7.11.0 to 7.11.6, 7.12.0 to 7.12.1.
Is there a fix for CVE-2026-12379?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-12379 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-12379?: Check whether you run Qt Group Axivion Dashboard at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An open redirect vulnerability (CWE-601) exists in the OAuth/OIDC authentication implementation of the Axivion Dashboard. The login flow fails to properly validate or restrict the post-authentication redirect URI to the application's own origin. An attacker can craft a legitimate-looking login URL containing a malicious redirect parameter; once the victim completes the authentication process against the genuine dashboard, the application redirects them to an external, attacker-controlled site. This is primarily used to facilitate phishing attacks or bypass security filters. The issue is fixed in Axivion versions 7.9.13, 7.10.11, 7.11.7, and 7.12.2.

Affected products

Qt Axivion Dashboard 7.8.0 to 7.8.12, 7.9.0 to 7.9.12, 7.10.0 to 7.10.10, 7.11.0 to 7.11.6, 7.12.0 to 7.12.1

Timeline

2026-07-16: advisory
2026-07-16: disclosed

References

https://wiki.qt.io/List_of_known_vulnerabilities_in_Qt_products

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.