Quick answers
- Is CVE-2026-18721 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-18721 being exploited in the wild.
- How severe is CVE-2026-18721?
- Medium severity, with a CVSS score of 4.3, published 4 August 2026.
- Which products and versions are affected?
- Kalcaddle Kodbox 1.67 Build 02.
- Is there a fix for CVE-2026-18721?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-18721 attacked?
- It is attacked over the network, in a web application.
- Am I affected by CVE-2026-18721?
- Check whether you run Kalcaddle Kodbox at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The vulnerability is an open redirect combined with token disclosure in the /user/sso/apiLogin endpoint. The SSO API login handler fails to validate the callbackUrl parameter against a whitelist of trusted domains. When a logged-in user is redirected via a crafted SSO request with an attacker-controlled callbackUrl, the application appends the sensitive kodTokenApi bearer token to the redirect URL. The attacker can capture this token from the browser redirect and exchange it for account access via the accessTokenGet endpoint, leading to account takeover. No user interaction beyond clicking a malicious link is required, and no attacker kodbox account is necessary—only that the victim be logged in at the time of clicking.
Affected products
- Kalcaddle kodbox 1.67 Build 02
Timeline
- 2026-06-15: disclosed: Vulnerability disclosed on GitHub
- 2026-08-04: advisory: CVE-2026-18721 published on NVD