Executive brief
Kalcaddle kodbox is a file management and cloud storage platform. An attacker can craft a malicious link that, when clicked by a logged-in user, redirects the user to an attacker-controlled website while leaking a sensitive API token. The attacker can then use this stolen token to take over the user's account without needing their own kodbox account.
Technical details
The vulnerability is an open redirect combined with token disclosure in the /user/sso/apiLogin endpoint. The SSO API login handler fails to validate the callbackUrl parameter against a whitelist of trusted domains. When a logged-in user is redirected via a crafted SSO request with an attacker-controlled callbackUrl, the application appends the sensitive kodTokenApi bearer token to the redirect URL. The attacker can capture this token from the browser redirect and exchange it for account access via the accessTokenGet endpoint, leading to account takeover. No user interaction beyond clicking a malicious link is required, and no attacker kodbox account is necessary—only that the victim be logged in at the time of clicking.
Affected products
- Kalcaddle kodbox 1.67 Build 02
Timeline
- 2026-06-15: disclosed: Vulnerability disclosed on GitHub
- 2026-08-04: advisory: CVE-2026-18721 published on NVD