Is CVE-2026-66414 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-66414 being exploited in the wild.

How severe is CVE-2026-66414?

Medium severity, with a CVSS score of 6.1, published 30 July 2026.

Is there a fix for CVE-2026-66414?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-66414 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-66414?

Check whether you run Leantime at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-66414: Leantime open redirect in Login controller

CVE-2026-66414 · Severity: medium · CVSS 6.1 · Published 2026-07-30

Leantime is a project management system designed for teams. A security flaw in its login page allows attackers to create deceptive links that redirect users to malicious external websites immediately after they log in. This can be used in phishing campaigns to trick employees into providing credentials or sensitive information to a site that looks legitimate but is controlled by an attacker.

Technologies: Leantime. Vendors: Leantime.

Quick answers

Is CVE-2026-66414 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-66414 being exploited in the wild.
How severe is CVE-2026-66414?: Medium severity, with a CVSS score of 6.1, published 30 July 2026.
Which products and versions are affected?: Leantime <= 3.6.2.
Is there a fix for CVE-2026-66414?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-66414 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-66414?: Check whether you run Leantime at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An open redirect vulnerability exists in the Login::post() method within app/Domain/Auth/Controllers/Login.php of Leantime versions up to and including 3.6.2. The application fails to properly validate the 'redirectUrl' POST parameter (and 'redirect' GET parameter) before performing a redirection after successful authentication. While the application attempted to use FILTER_SANITIZE_URL, this validation is insufficient to prevent redirection to external domains. An unauthenticated remote attacker can craft a malicious URL that, once a user logs in, redirects them to an attacker-controlled domain. This is primarily used for phishing and credential harvesting. A fix involving the resolveSafeRedirect() helper has been proposed in pull request #3658.

Affected products

Leantime Leantime <= 3.6.2

Timeline

2026-07-03: other: Reported to vendor security email
2026-07-17: other: Fix pull request submitted on GitHub
2026-07-20: disclosed: Researcher published security advisory GHSA-wprg-q8m6-jhp9
2026-07-30: advisory: CVE-2026-66414 published by VulnCheck and NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.