Executive brief
Saltcorn, an open-source no-code database application builder, is vulnerable to an open redirect flaw during the login process. An attacker can trick a user into clicking a specially crafted link that, after a successful login, redirects the user to a malicious website. This can be used for phishing attacks to steal user credentials by mimicking a legitimate session timeout or login prompt.
Technical details
An open redirect vulnerability exists in Saltcorn's `POST /auth/login` route due to a bypass in the `is_relative_url` validation function. The function only checks for the presence of `:/` and `//` to identify absolute URLs, failing to account for backslashes (`\`) which modern WHATWG-compliant browsers normalize to forward slashes. An attacker can provide a payload like `/\evil.com/path` which passes the check but causes a cross-origin redirect. Additionally, the function fails to block non-http schemes like `javascript:` or `data:`. The vulnerability is patched in versions 1.4.6, 1.5.6, and 1.6.0-beta.5.
Affected products
- Saltcorn Saltcorn < 1.4.6, >= 1.5.0-beta.0 < 1.5.6, >= 1.6.0-alpha.0 < 1.6.0-beta.5
Timeline
- 2026-04-16: advisory
- 2026-04-16: disclosed
- 2026-05-07: kev added: NVD Published Date