# CVE-2026-58450: Invoice Ninja open redirect in client portal login

Source: https://junglewise.ai/threats/cve-2026-58450-invoice-ninja-open-redirect-in-client-portal-login  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-30. Updated: 2026-06-30  
License: CC BY 4.0 with a link back

CVE-2026-58450 · Severity: medium · CVSS 4.3 · Published 2026-06-30

Invoice Ninja, an open-source invoicing and payment management platform, is vulnerable to a security flaw that allows attackers to redirect users to malicious websites. By sending a specially crafted login link to a customer, an attacker can wait for the user to log in to the legitimate portal and then automatically redirect them to a fraudulent site. This can be used to conduct highly convincing phishing attacks to steal payment information or login credentials.

Technologies: [Invoice Ninja](https://junglewise.ai/threats/technologies/invoice-ninja). Vendors: [Invoice Ninja](https://junglewise.ai/threats/vendors/invoice-ninja).

## Quick answers

**Is CVE-2026-58450 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-58450 being exploited in the wild.

**How severe is CVE-2026-58450?** Medium severity, with a CVSS score of 4.3, published 30 June 2026.

**Which products and versions are affected?** Invoice Ninja through 5.13.26.

**Is there a fix for CVE-2026-58450?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-58450 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-58450?** Check whether you run Invoice Ninja at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An open redirect vulnerability (CWE-601) exists in Invoice Ninja through version 5.13.26 within the ContactLoginController. The application accepts an 'intended' query parameter during the client portal login process and stores it in the PHP session without host or domain validation. Upon successful authentication, the 'authenticated()' handler retrieves this value and performs a bare redirect, bypassing Laravel's built-in URL protections. An unauthenticated attacker can craft a malicious URL that, once visited by a victim who subsequently logs in, redirects the victim to an arbitrary external domain. This flaw facilitates sophisticated phishing campaigns by leveraging the trust of the initial legitimate login page.

## Affected products

- Invoice Ninja Invoice Ninja through 5.13.26

## Timeline

- 2026-05-14: disclosed: Initial researcher report to vendor
- 2026-06-30: advisory: NVD and VulnCheck advisory published

## References

- [https://github.com/invoiceninja/invoiceninja/issues/12039](https://github.com/invoiceninja/invoiceninja/issues/12039)
- [https://www.vulncheck.com/advisories/invoice-ninja-open-redirect-in-client-portal-login-via-intended-parameter](https://www.vulncheck.com/advisories/invoice-ninja-open-redirect-in-client-portal-login-via-intended-parameter)

## Related threats

- [Invoice Ninja broken access control in vendor document download](https://junglewise.ai/threats/cve-2026-82029-invoice-ninja-before-5-13-28-contains-a-broken-access-control)
- [Invoice Ninja information disclosure via webhook components](https://junglewise.ai/threats/cve-2026-71626-invoice-ninja-information-disclosure-via-webhook-components)
- [Invoice Ninja server-side request forgery in PDF rendering](https://junglewise.ai/threats/cve-2026-83744-invoice-ninja-server-side-request-forgery-in-pdf-rendering)
- [Invoice Ninja authorization bypass in vendor portal profile](https://junglewise.ai/threats/cve-2026-83743-invoice-ninja-authorization-bypass-in-vendor-portal-profile)