# CVE-2026-18721: Kalcaddle kodbox open redirect with token disclosure in SSO API

Source: https://junglewise.ai/threats/cve-2026-18721-kalcaddle-kodbox-open-redirect-with-token-disclosure-in-sso-api  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-04. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-18721 · Severity: medium · CVSS 4.3 · Published 2026-08-04

Kalcaddle kodbox is a file management and cloud storage platform. An attacker can craft a malicious link that, when clicked by a logged-in user, redirects the user to an attacker-controlled website while leaking a sensitive API token. The attacker can then use this stolen token to take over the user's account without needing their own kodbox account.

Technologies: [Kalcaddle Kodbox](https://junglewise.ai/threats/technologies/kodbox). Vendors: [Kalcaddle](https://junglewise.ai/threats/vendors/kalcaddle).

## Quick answers

**Is CVE-2026-18721 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-18721 being exploited in the wild.

**How severe is CVE-2026-18721?** Medium severity, with a CVSS score of 4.3, published 4 August 2026.

**Which products and versions are affected?** Kalcaddle Kodbox 1.67 Build 02.

**Is there a fix for CVE-2026-18721?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-18721 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-18721?** Check whether you run Kalcaddle Kodbox at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is an open redirect combined with token disclosure in the /user/sso/apiLogin endpoint. The SSO API login handler fails to validate the callbackUrl parameter against a whitelist of trusted domains. When a logged-in user is redirected via a crafted SSO request with an attacker-controlled callbackUrl, the application appends the sensitive kodTokenApi bearer token to the redirect URL. The attacker can capture this token from the browser redirect and exchange it for account access via the accessTokenGet endpoint, leading to account takeover. No user interaction beyond clicking a malicious link is required, and no attacker kodbox account is necessary—only that the victim be logged in at the time of clicking.

## Affected products

- Kalcaddle kodbox 1.67 Build 02

## Timeline

- 2026-06-15: disclosed: Vulnerability disclosed on GitHub
- 2026-08-04: advisory: CVE-2026-18721 published on NVD

## References

- [https://github.com/sjmycz/cve/issues/6](https://github.com/sjmycz/cve/issues/6)
- [https://vuldb.com/cve/CVE-2026-18721](https://vuldb.com/cve/CVE-2026-18721)

## Related threats

- [kalcaddle kodbox unauthenticated SMTP configuration disclosure in msgWarning plugin](https://junglewise.ai/threats/cve-2026-18720-kalcaddle-kodbox-unauthenticated-smtp-configuration-disclosure-in)
- [Kalcaddle Kodbox command injection in fileThumb plugin](https://junglewise.ai/threats/cve-2026-8753-kalcaddle-kodbox-command-injection-in-filethumb-plugin)
- [Kalcaddle kodbox SSRF in shareMake/shareCheck](https://junglewise.ai/threats/cve-2026-5618-kalcaddle-kodbox-ssrf-in-sharemake-sharecheck)