# CVE-2026-42259: Saltcorn open redirect in login via backslash bypass

Source: https://junglewise.ai/threats/cve-2026-42259-saltcorn-open-redirect-in-login-via-backslash-bypass  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-04-16. Updated: 2026-05-11  
License: CC BY 4.0 with a link back

CVE-2026-42259 · Severity: medium · CVSS 4 · Published 2026-04-16

Saltcorn, an open-source no-code database application builder, is vulnerable to an open redirect flaw during the login process. An attacker can trick a user into clicking a specially crafted link that, after a successful login, redirects the user to a malicious website. This can be used for phishing attacks to steal user credentials by mimicking a legitimate session timeout or login prompt.

Technologies: [@saltcorn/server (npm)](https://junglewise.ai/threats/technologies/saltcorn-server), [Saltcorn](https://junglewise.ai/threats/technologies/saltcorn). Vendors: [npm](https://junglewise.ai/threats/vendors/npm), [Saltcorn](https://junglewise.ai/threats/vendors/saltcorn).

## Quick answers

**Is CVE-2026-42259 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-42259 being exploited in the wild.

**How severe is CVE-2026-42259?** Medium severity, with a CVSS score of 4, published 16 April 2026.

**Which products and versions are affected?** @saltcorn/server (npm) SEMVER:introduced=0,fixed=1.4.6; Saltcorn < 1.4.6, >= 1.5.0-beta.0 < 1.5.6, >= 1.6.0-alpha.0 < 1.6.0-beta.5.

**Is there a fix for CVE-2026-42259?** Yes. @saltcorn/server (npm): upgrade to 1.4.6 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-42259 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-42259?** Check whether you run @saltcorn/server (npm) or Saltcorn at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- @saltcorn/server (npm): upgrade to 1.4.6 or later

  ```sh
  npm install @saltcorn/server@1.4.6
  ```


## Technical details

An open redirect vulnerability exists in Saltcorn's `POST /auth/login` route due to a bypass in the `is_relative_url` validation function. The function only checks for the presence of `:/` and `//` to identify absolute URLs, failing to account for backslashes (`\`) which modern WHATWG-compliant browsers normalize to forward slashes. An attacker can provide a payload like `/\evil.com/path` which passes the check but causes a cross-origin redirect. Additionally, the function fails to block non-http schemes like `javascript:` or `data:`. The vulnerability is patched in versions 1.4.6, 1.5.6, and 1.6.0-beta.5.

## Affected products

- Saltcorn Saltcorn < 1.4.6, >= 1.5.0-beta.0 < 1.5.6, >= 1.6.0-alpha.0 < 1.6.0-beta.5

## Identifiers

- CVE-2026-42259
- GHSA-f3g8-9xv5-77gv

## Timeline

- 2026-04-16: advisory
- 2026-04-16: disclosed
- 2026-05-07: kev added: NVD Published Date

## References

- [https://github.com/saltcorn/saltcorn/security/advisories/GHSA-f3g8-9xv5-77gv](https://github.com/saltcorn/saltcorn/security/advisories/GHSA-f3g8-9xv5-77gv)
- [https://api.github.com/repos/saltcorn/saltcorn/security-advisories/GHSA-f3g8-9xv5-77gv](https://api.github.com/repos/saltcorn/saltcorn/security-advisories/GHSA-f3g8-9xv5-77gv)

## Related threats

- [Saltcorn: SQL Injection via Unparameterized Sync Endpoints (maxLoadedId)](https://junglewise.ai/threats/cve-2026-41478-saltcorn-sql-injection-via-unparameterized-sync-endpoints)
- [Saltcorn @saltcorn/data SQL injection in jsexprToSQL Literal Handler](https://junglewise.ai/threats/saltcorn-saltcorn-data-sql-injection-in-jsexprtosql-literal-handler-bdaf86bc)
- [Saltcorn path traversal in mobile sync endpoints](https://junglewise.ai/threats/cve-2026-40163-saltcorn-path-traversal-in-mobile-sync-endpoints)
- [Saltcorn reflected XSS and command injection chaining for RCE](https://junglewise.ai/threats/saltcorn-reflected-xss-and-command-injection-chaining-for-rce-91ca3009)
- [Saltcorn Server stored XSS in event logs page](https://junglewise.ai/threats/saltcorn-server-stored-xss-in-event-logs-page-29714f98)