CVE-2026-128637

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-128637", "assignerOrgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8", "state": "PUBLISHED", "assignerShortName": "CIRCL", "dateReserved": "2026-11-13T07:15:13.649Z", "datePublished": "2026-11-13T07:15:18.086Z", "dateUpdated": "2026-11-13T07:15:18.086Z"}, "containers": {"cna": {"descriptions": [{"lang": "en", "value": "The MISP Modules website component contains an open redirect vulnerability in its login endpoint. The /login route accepted a user-supplied next query parameter and passed it directly to Flask's redirect() function without validating the destination. An attacker could craft a URL such as https://victim-host/login?next=https://attacker.example/phish and deliver it to a user (e.g., via email or a lookalike page). After the user successfully authenticated, the application issued a 302 redirect to the attacker-controlled external URL. This enables phishing attacks where a user, believing they are still on the legitimate MISP Modules site, may enter additional credentials or sensitive information on the attacker's page. It can also be used to obscure the true destination of a link, bypassing user trust in the legitimate domain. The vulnerability requires the victim to interact with the crafted URL and complete a login, but no prior authentication or special configuration is needed on the attacker's side. The affected component is the website sub-project of misp-modules, specifically the account blueprint in website/app/account/account.py. No version boundaries are specified in the patch metadata."}], "affected": [{"vendor": "misp", "product": "misp-modules", "cpes": ["cpe:2.3:a:misp:misp-modules:*:*:*:*:*:*:*:*"], "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "3.1.4", "versionType": "semver"}], "modules": ["website"], "programFiles": ["website/app/account/account.py"], "repo": "https://github.com/MISP/misp-modules"}], "references": [{"url": "https://github.com/MISP/misp-modules/commit/d115f00414e761b0b70c8c8671edac681de74a4c", "name": "Security patch", "tags": ["patch"]}], "x_gcve": [{"recordType": "advisory", "extensions": {"bcp-05-x-01": {"ai_annotations": [{"scope": "record", "gna_source": 1, "tags": ["ai-computer-assisted:llm-generated", "ai-computer-assisted:classification"], "description": "Draft vulnerability metadata was generated from a git-format patch using an Ollama-hosted language model. Human validation is required before publication.", "ai_level": "generated", "review_status": "full", "models": [{"name": "qwen3.8:27b", "gna_source": 1, "source": "ollama", "identifier": "qwen3.8:27b"}]}]}, "bcp-05-x-02": {"x_patch2vuln": {"generator": "patch2vuln.py", "generatedAt": "2026-11-13T07:10:51.231558Z", "model": "qwen3.8:27b", "source": "https://github.com/MISP/misp-modules/commit/d115f00414e761b0b70c8c8671edac681de74a4c.patch", "patchSha256": "4b395e050af927c4d1a6033230f563b7d397ebcadcd72e6a56d7e61428aa31ea", "patchTruncated": false, "commit": "d115f00414e761b0b70c8c8671edac681de74a4c", "subject": "fix: [website] restrict post-login redirects to local paths", "patches": [{"source": "https://github.com/MISP/misp-modules/commit/d115f00414e761b0b70c8c8671edac681de74a4c.patch", "sourceUrl": "https://github.com/MISP/misp-modules/commit/d115f00414e761b0b70c8c8671edac681de74a4c.patch", "patchSha256": "4b395e050af927c4d1a6033230f563b7d397ebcadcd72e6a56d7e61428aa31ea", "commit": "d115f00414e761b0b70c8c8671edac681de74a4c", "subject": "fix: [website] restrict post-login redirects to local paths", "date": "Fri, 13 Nov 2026 06:49:26 +0100", "retrievedAt": "2026-11-13T07:10:04.602453Z"}], "confidence": "high", "assumptions": ["No specific affected or fixed version is identified in the patch metadata; the version range is recorded as unspecified.", "The CVSS UI metric is set to Active (A) on the assumption that the victim must click a crafted link and submit login credentials; if the login page is auto-submitted in a phishing context, UI could be argued as Passive, but the evidence supports Active.", "SC is set to Low based on the phishing/social-engineering risk of redirecting a user to an external site after login; no direct data exfiltration mechanism is present in the vulnerable code path.", "The CAPEC-113 mapping is the closest available pattern for open redirect; no more specific CAPEC exists for post-login redirect manipulation.", "The patch does not indicate whether this vulnerability was reported through a coordinated disclosure process; no finder or reporter credit is assigned beyond the remediation developer.", "The website component is assumed to be a Flask-based web application served over HTTP(S); the patch does not specify deployment topology or additional authentication layers."], "fixSummary": "The fix introduces a _safe_next_url() validation function that restricts post-login redirect destinations to local paths or same-host HTTP(S) URLs. Any target that is empty, contains backslashes, control characters, leading/trailing whitespace, an unrecognized scheme, a mismatched host, or a protocol-relative form is rejected and the user is redirected to the home page (/). Accepted same-host URLs are normalized to local paths (scheme and authority stripped) while preserving query strings and fragments, ensuring the Location header always contains a relative path. This eliminates the ability to redirect users to arbitrary external destinations after authentication.", "patchSummary": "In website/app/account/account.py, the import of urlsplit and urlunsplit from urllib.parse is added. A new _safe_next_url() function is defined that validates the target string against a series of safety checks (whitespace, backslashes, control characters, scheme allowlist, host match, protocol-relative rejection, double-slash path rejection) and returns either a normalized local path or the fallback '/'. The login() handler's redirect call is changed from redirect(request.args.get('next') or '/') to redirect(_safe_next_url(request.args.get('next'))). A new test file website/tests/login_checks.py (172 lines) is added with comprehensive unit tests covering external rejection, malformed input rejection, local path preservation, same-host-with-port normalization, wrong-password non-redirect, CSRF enforcement, and remember-me cookie preservation. The website README is updated to document the new redirect validation behavior.", "credits": [{"lang": "en", "value": "Alexandre Dulaunoy", "type": "remediation developer"}], "cvssRationale": "AV:N: exploitable over the network via a crafted URL. AC:L: no race conditions or special conditions; simply append a next parameter. AT:N: no attack requirements beyond delivering the URL. PR:N: the attacker needs no account; the victim performs the login. UI:A: the victim must actively visit the crafted URL and submit credentials. VC/VI/VA:N: the vulnerable system itself suffers no direct confidentiality, integrity, or availability loss. SC:L: subsequent confidentiality impact is low because the redirected user may be tricked into entering sensitive data on a phishing page, but the session cookie is domain-scoped and not directly exfiltrated. SI/SA:N: no subsequent integrity or availability impact is evidenced.", "ssvc": {"version": "2.0.3", "role": "Supplier", "timestamp": "2026-11-13T07:10:51Z", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}]}, "weaknessRationale": [{"cweId": "CWE-601", "rationale": "The login endpoint accepted an unvalidated user-supplied URL in the next query parameter and used it directly as the redirect destination, allowing an attacker to redirect authenticated users to arbitrary external sites. This is a textbook open redirect (CWE-601)."}], "capecRationale": [{"capecId": "CAPEC-113", "rationale": "The patch directly addresses an open redirect: an attacker crafts a login URL with a malicious next parameter to redirect the victim to an external phishing site after authentication. CAPEC-113 describes exactly this attack pattern where a web application redirects to a user-controlled destination without proper validation. This is the closest and most precise CAPEC mapping available for this vulnerability class."}], "draft": false, "modelComparison": {"selectedModel": "qwen3.8:27b", "selectionMethod": "deterministic-consensus-v1", "selectionNotice": "The selected result is closest to model consensus; this heuristic does not establish factual correctness and human review remains required.", "rankings": [{"model": "qwen3.8:27b", "score": 7, "agreementScore": 11, "confidence": "high", "assumptionCount": 6}], "potentialErrors": []}}}, "bcp-05-x-03": {"x_timeline": {"events": [{"type": "fix-developed", "timestamp": "2026-11-13T05:49:26Z", "description": "Corrective change authored (d115f00414e761b0b70c8c8671edac681de74a4c): fix: [website] restrict post-login redirects to local paths", "references": ["https://github.com/MISP/misp-modules/commit/d115f00414e761b0b70c8c8671edac681de74a4c.patch"], "id": "evt-fix-developed-1"}, {"id": "evt-fix-available-1", "type": "fix-available", "timestamp": "2026-11-13T07:10:04.602453Z", "description": "Patch retrieved from the supplied URL; retrieval time is used as the default availability time.", "references": ["https://github.com/MISP/misp-modules/commit/d115f00414e761b0b70c8c8671edac681de74a4c.patch"]}]}}}, "vulnId": "gcve-1-2026-20325"}], "title": "Open Redirect in MISP Modules Website Login via Unvalidated next Parameter", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-601", "description": "CWE-601 Open Redirect", "type": "CWE"}]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV4_0": {"version": "4.0", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N", "baseScore": 5.1, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "ACTIVE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "LOW", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED"}}, {"format": "SSVC", "scenarios": [{"lang": "en", "value": "GENERAL"}], "other": {"type": "SSVC", "content": {"version": "2.0.3", "role": "Supplier", "timestamp": "2026-11-13T07:10:51Z", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}]}}}], "solutions": [{"lang": "en", "value": "The fix introduces a _safe_next_url() validation function that restricts post-login redirect destinations to local paths or same-host HTTP(S) URLs. Any target that is empty, contains backslashes, control characters, leading/trailing whitespace, an unrecognized scheme, a mismatched host, or a protocol-relative form is rejected and the user is redirected to the home page (/). Accepted same-host URLs are normalized to local paths (scheme and authority stripped) while preserving query strings and fragments, ensuring the Location header always contains a relative path. This eliminates the ability to redirect users to arbitrary external destinations after authentication."}], "impacts": [{"capecId": "CAPEC-113", "descriptions": [{"lang": "en", "value": "CAPEC-113 Open Redirect"}]}], "credits": [{"lang": "en", "value": "Alexandre Dulaunoy", "type": "remediation developer"}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:misp:misp-modules:*:*:*:*:*:*:*:*", "versionStartIncluding": "0", "versionEndIncluding": "3.1.4"}]}]}], "providerMetadata": {"orgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8", "shortName": "CIRCL", "dateUpdated": "2026-11-13T07:15:18.086Z"}}}}

{}

{}

{}

{}