# CVE-2026-12863: Pretix Venueless open redirect in social login functionality

Source: https://junglewise.ai/threats/cve-2026-12863-pretix-venueless-open-redirect-in-social-login-functionality  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-22. Updated: 2026-06-22  
License: CC BY 4.0 with a link back

CVE-2026-12863 · Severity: info · CVSS 5.1 · Published 2026-06-22

Venueless, a platform for virtual events, contains a security flaw in its social login feature. An attacker can create a malicious link that appears to be a legitimate login page but redirects the user to a fraudulent website after they sign in. This can be used in phishing campaigns to trick users into visiting malicious sites while believing they are still on a trusted domain.

Technologies: [Pretix Venueless](https://junglewise.ai/threats/technologies/venueless). Vendors: [Pretix](https://junglewise.ai/threats/vendors/pretix).

## Quick answers

**Is CVE-2026-12863 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-12863 being exploited in the wild.

**How severe is CVE-2026-12863?** Informational severity, with a CVSS score of 5.1, published 22 June 2026.

**Which products and versions are affected?** Pretix Venueless < d27864a7 (git).

**Is there a fix for CVE-2026-12863?** A patch was published on 2026-06-22. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-12863 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-12863?** Check whether you run Pretix Venueless at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An open redirect vulnerability (CWE-601) exists in the social login component of Venueless. The application fails to properly validate the destination URL in the redirect parameter after a user completes the social authentication process. A remote attacker can craft a URL that leverages the trusted domain of the Venueless instance to redirect authenticated users to an arbitrary external site. Exploitation requires the attacker to have low privileges and for a victim to interact with the malicious link. The issue has been addressed in commit d27864a7.

## Affected products

- pretix Venueless < d27864a7 (git)

## Timeline

- 2026-06-22: disclosed
- 2026-06-22: advisory
- 2026-06-22: patched

## References

- [https://github.com/venueless/venueless/security/advisories/GHSA-m87f-7c4r-w4p3](https://github.com/venueless/venueless/security/advisories/GHSA-m87f-7c4r-w4p3)

## Related threats

- [Pretix Venueless formula injection in Excel exports](https://junglewise.ai/threats/cve-2026-12862-pretix-venueless-formula-injection-in-excel-exports)
- [pretix Venueless improper isolation allows cross-world user deletion](https://junglewise.ai/threats/cve-2026-5599-pretix-venueless-improper-isolation-allows-cross-world-user)