Executive brief
A security vulnerability exists where a web application fails to properly validate destination links, allowing for an 'open redirect.' Attackers can use this to create malicious links that appear to belong to a trusted site but instead send users to a fraudulent or harmful website. This is commonly used in phishing campaigns to steal user credentials or distribute malware by leveraging the reputation of the trusted domain.
Technical details
The application is vulnerable to an open redirect (CWE-601) due to insufficient validation of user-supplied input used in redirection targets. An unauthenticated remote attacker can craft a specific URL that, when clicked by a victim, redirects the browser to an arbitrary external domain. This vulnerability is exploited via the network and requires minimal user interaction (clicking a link). While it does not directly allow for data exfiltration from the server, it is a primary vector for phishing and social engineering attacks. The specific vendor and product were not identified in the initial advisory, but the flaw was reported by the Israel National Cyber Directorate.
Affected products
- Unknown Vendor Unknown Product
Timeline
- 2026-05-14: advisory: Advisory published by the Israel National Cyber Directorate and NVD.