Is CVE-2026-45566 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-45566 being exploited in the wild.

How severe is CVE-2026-45566?

Medium severity, with a CVSS score of 6.1, published 10 June 2026.

Is there a fix for CVE-2026-45566?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-45566 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-45566?

Check whether you run Roxy-WI at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-45566: Roxy-WI open redirect in login flow via userinfo syntax bypass

CVE-2026-45566 · Severity: medium · CVSS 6.1 · Published 2026-06-10

Roxy-WI, a management interface for web servers like Nginx and HAProxy, contains a security flaw in its login process. An attacker can trick users into visiting a malicious website by sending them a specially crafted link that appears to belong to the legitimate Roxy-WI server. This can be used in phishing attacks to steal user credentials or sensitive configuration data by mimicking the real application after the user logs in.

Technologies: Roxy-WI. Vendors: Roxy-WI.

Quick answers

Is CVE-2026-45566 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-45566 being exploited in the wild.
How severe is CVE-2026-45566?: Medium severity, with a CVSS score of 6.1, published 10 June 2026.
Which products and versions are affected?: Roxy-WI <= 8.2.6.4.
Is there a fix for CVE-2026-45566?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-45566 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-45566?: Check whether you run Roxy-WI at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An open redirect vulnerability (CWE-601) exists in Roxy-WI versions 8.2.6.4 and prior within the login flow. The application attempts to validate the 'next' parameter by checking for 'http://' or 'https://' substrings; however, it fails to account for the RFC 3986 userinfo syntax (e.g., @evil.com). When the application constructs the redirect URL as 'https://{request.host}{next_url}', a payload like '@evil.com' results in a URL that modern browsers interpret as having 'evil.com' as the authority. This allows a remote, unauthenticated attacker to redirect users to arbitrary external sites via a crafted URL. As of the advisory date, no official patches are available, though the advisory suggests implementing 'urllib.parse' for proper URL validation.

Affected products

Roxy-WI roxy-wi <= 8.2.6.4

Timeline

2026-05-15: advisory: GitHub Security Advisory published
2026-06-10: disclosed: CVE published to NVD

References

https://github.com/roxy-wi/roxy-wi/security/advisories/GHSA-xw9x-68gg-mp5h

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.