Executive brief
Leantime is a project management system designed for teams. A security flaw in its login page allows attackers to create deceptive links that redirect users to malicious external websites immediately after they log in. This can be used in phishing campaigns to trick employees into providing credentials or sensitive information to a site that looks legitimate but is controlled by an attacker.
Technical details
An open redirect vulnerability exists in the Login::post() method within app/Domain/Auth/Controllers/Login.php of Leantime versions up to and including 3.6.2. The application fails to properly validate the 'redirectUrl' POST parameter (and 'redirect' GET parameter) before performing a redirection after successful authentication. While the application attempted to use FILTER_SANITIZE_URL, this validation is insufficient to prevent redirection to external domains. An unauthenticated remote attacker can craft a malicious URL that, once a user logs in, redirects them to an attacker-controlled domain. This is primarily used for phishing and credential harvesting. A fix involving the resolveSafeRedirect() helper has been proposed in pull request #3658.
Affected products
- Leantime Leantime <= 3.6.2
Timeline
- 2026-07-03: other: Reported to vendor security email
- 2026-07-17: other: Fix pull request submitted on GitHub
- 2026-07-20: disclosed: Researcher published security advisory GHSA-wprg-q8m6-jhp9
- 2026-07-30: advisory: CVE-2026-66414 published by VulnCheck and NVD