Executive brief
Invoice Ninja, an open-source invoicing and payment management platform, is vulnerable to a security flaw that allows attackers to redirect users to malicious websites. By sending a specially crafted login link to a customer, an attacker can wait for the user to log in to the legitimate portal and then automatically redirect them to a fraudulent site. This can be used to conduct highly convincing phishing attacks to steal payment information or login credentials.
Technical details
An open redirect vulnerability (CWE-601) exists in Invoice Ninja through version 5.13.26 within the ContactLoginController. The application accepts an 'intended' query parameter during the client portal login process and stores it in the PHP session without host or domain validation. Upon successful authentication, the 'authenticated()' handler retrieves this value and performs a bare redirect, bypassing Laravel's built-in URL protections. An unauthenticated attacker can craft a malicious URL that, once visited by a victim who subsequently logs in, redirects the victim to an arbitrary external domain. This flaw facilitates sophisticated phishing campaigns by leveraging the trust of the initial legitimate login page.
Affected products
- Invoice Ninja Invoice Ninja through 5.13.26
Timeline
- 2026-05-14: disclosed: Initial researcher report to vendor
- 2026-06-30: advisory: NVD and VulnCheck advisory published