# CVE-2026-45566: Roxy-WI open redirect in login flow via userinfo syntax bypass

Source: https://junglewise.ai/threats/cve-2026-45566-roxy-wi-open-redirect-in-login-flow-via-userinfo-syntax-bypass  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-10. Updated: 2026-06-10  
License: CC BY 4.0 with a link back

CVE-2026-45566 · Severity: medium · CVSS 6.1 · Published 2026-06-10

Roxy-WI, a management interface for web servers like Nginx and HAProxy, contains a security flaw in its login process. An attacker can trick users into visiting a malicious website by sending them a specially crafted link that appears to belong to the legitimate Roxy-WI server. This can be used in phishing attacks to steal user credentials or sensitive configuration data by mimicking the real application after the user logs in.

Technologies: [Roxy-WI](https://junglewise.ai/threats/technologies/roxy-wi). Vendors: [Roxy-WI](https://junglewise.ai/threats/vendors/roxy-wi).

## Quick answers

**Is CVE-2026-45566 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-45566 being exploited in the wild.

**How severe is CVE-2026-45566?** Medium severity, with a CVSS score of 6.1, published 10 June 2026.

**Which products and versions are affected?** Roxy-WI <= 8.2.6.4.

**Is there a fix for CVE-2026-45566?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-45566 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-45566?** Check whether you run Roxy-WI at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An open redirect vulnerability (CWE-601) exists in Roxy-WI versions 8.2.6.4 and prior within the login flow. The application attempts to validate the 'next' parameter by checking for 'http://' or 'https://' substrings; however, it fails to account for the RFC 3986 userinfo syntax (e.g., @evil.com). When the application constructs the redirect URL as 'https://{request.host}{next_url}', a payload like '@evil.com' results in a URL that modern browsers interpret as having 'evil.com' as the authority. This allows a remote, unauthenticated attacker to redirect users to arbitrary external sites via a crafted URL. As of the advisory date, no official patches are available, though the advisory suggests implementing 'urllib.parse' for proper URL validation.

## Affected products

- Roxy-WI roxy-wi <= 8.2.6.4

## Timeline

- 2026-05-15: advisory: GitHub Security Advisory published
- 2026-06-10: disclosed: CVE published to NVD

## References

- [https://github.com/roxy-wi/roxy-wi/security/advisories/GHSA-xw9x-68gg-mp5h](https://github.com/roxy-wi/roxy-wi/security/advisories/GHSA-xw9x-68gg-mp5h)

## Related threats

- [Roxy-WI path traversal in configuration management](https://junglewise.ai/threats/cve-2026-45569-roxy-wi-path-traversal-in-configuration-management)
- [Roxy-WI authentication bypass via URL substring manipulation](https://junglewise.ai/threats/cve-2026-45567-roxy-wi-authentication-bypass-via-url-substring-manipulation)
- [Roxy-WI input validation bypass in EscapedString validator](https://junglewise.ai/threats/cve-2026-45565-roxy-wi-input-validation-bypass-in-escapedstring-validator)
- [Roxy-WI command injection in config versions save route](https://junglewise.ai/threats/cve-2026-45564-roxy-wi-command-injection-in-config-versions-save-route)
- [Roxy-WI authorization bypass in history endpoint](https://junglewise.ai/threats/cve-2026-45563-roxy-wi-authorization-bypass-in-history-endpoint)