Executive brief
Pachno, an open-source project management and collaboration platform, is vulnerable to a flaw that allows attackers to redirect users to malicious external websites. By sending a specially crafted link, an attacker can trick a user into visiting a fake login page or a site hosting malware while making it appear as though the link is legitimate. This can lead to the theft of user credentials and sensitive corporate data through phishing.
Technical details
An open redirection vulnerability exists in Pachno version 1.0.6 and earlier due to insufficient validation of the 'return_to' parameter during the login process. A remote, unauthenticated attacker can exploit this by crafting a URL that includes a malicious external domain in the affected parameter. When a user clicks the link and successfully authenticates, the application automatically redirects them to the attacker-controlled site. This vulnerability is primarily used to facilitate phishing attacks or to bypass security filters that trust the host domain. The issue is tracked as CWE-305 and has been assigned a CVSS v3.1 base score of 6.5.
Affected products
- Pachno Pachno <= 1.0.6
Timeline
- 2026-04-13: disclosed: Initial disclosure by Zero Science Lab
- 2026-04-13: advisory: CVE-2026-40039 published