# CVE-2026-78145: CTFd open redirect in URL validation

Source: https://junglewise.ai/threats/cve-2026-78145-ctfd-open-redirect-in-url-validation  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-23. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-78145 · Severity: medium · CVSS 4.3 · Published 2026-08-23

CTFd is a platform for hosting Capture The Flag (CTF) security competitions. An attacker can manipulate the redirect parameter to redirect users to an arbitrary external website, enabling phishing attacks or spreading malware. This occurs because the URL validation function (_is_safe_url) can be bypassed, allowing attackers to serve malicious links to other users.

Technologies: [CTFd](https://junglewise.ai/threats/technologies/ctfd). Vendors: [CTFd](https://junglewise.ai/threats/vendors/ctfd).

## Quick answers

**Is CVE-2026-78145 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-78145 being exploited in the wild.

**How severe is CVE-2026-78145?** Medium severity, with a CVSS score of 4.3, published 23 August 2026.

**Which products and versions are affected?** CTFd up to 3.8.4.

**Is there a fix for CVE-2026-78145?** A patch was published on 2026-04-20: Patch commit 5d8515842fd1ab2c3a9f2dde9ffca907aa334ea9 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-78145 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-78145?** Check whether you run CTFd at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

This is an open redirect vulnerability in the _is_safe_url function within CTFd/utils/validators/__init__.py. The vulnerability exists because the URL validation logic fails to properly sanitize the "Next" parameter, allowing an attacker to craft a malicious URL that bypasses the safe-URL check. The attack is remotely exploitable and does not require authentication. An attacker can redirect users to arbitrary external sites, potentially for phishing or credential harvesting. The vulnerability has been patched in commit 5d8515842fd1ab2c3a9f2dde9ffca907aa334ea9 and users should upgrade to the patched version.

## Affected products

- CTFd CTFd up to 3.8.4

## Timeline

- 2026-08-23: disclosed
- 2026-04-20: patched: Patch commit 5d8515842fd1ab2c3a9f2dde9ffca907aa334ea9

## References

- [https://github.com/CTFd/CTFd/](https://github.com/CTFd/CTFd/)
- [https://github.com/CTFd/CTFd/commit/5d8515842fd1ab2c3a9f2dde9ffca907aa334ea9](https://github.com/CTFd/CTFd/commit/5d8515842fd1ab2c3a9f2dde9ffca907aa334ea9)

## Related threats

- [CTFd information disclosure in /api/v1/teams endpoint](https://junglewise.ai/threats/cve-2026-121562-ctfd-3-1-0-before-3-8-7-contains-an-information-disclosure)
- [CTFd man-in-the-middle attack vulnerability](https://junglewise.ai/threats/cve-2025-29419-ctfd-man-in-the-middle-attack-vulnerability)