Description
Pachno 1.0.6 contains an open redirection vulnerability that allows attackers to redirect users to arbitrary external websites by manipulating the return_to parameter. Attackers can craft malicious login URLs with unvalidated return_to values to conduct phishing attacks and steal user credentials.
Published: 2026-04-13
Score: 7.1 High
EPSS: < 1% Very Low
KEV: No
Impact: Open Redirection enabling phishing and credential theft
Action: Patch
AI Analysis

Impact

Pachno 1.0.6 contains a flaw that lets attackers set the return_to parameter to any URL, causing users to be redirected to malicious sites. This can lead to phishing, credential harvesting, and other social‑engineering attacks. The weakness arises from insufficient validation of the parameter, categorized as CWE‑305.

Affected Systems

The issue affects the Pachno project management tool from the vendor pancho, specifically version 1.0.6.

Risk and Exploitability

The vulnerability carries a CVSS base score of 7.1, indicating a high risk to users. No EPSS data is available and it is not listed in the CISA KEV catalog, so the probability of widespread exploitation remains unclear. Attackers can exploit the flaw remotely by forging a login URL with a crafted return_to value, which does not require authentication and can be shared publicly.

Generated by OpenCVE AI on April 13, 2026 at 19:22 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Update Pachno to a fixed version (1.0.7 or later).
  • If an update cannot be applied immediately, restrict or validate the return_to parameter to allow only trusted internal URLs.

Generated by OpenCVE AI on April 13, 2026 at 19:22 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 13 Apr 2026 18:30:00 +0000

Type Values Removed Values Added
Description Pachno 1.0.6 contains an open redirection vulnerability that allows attackers to redirect users to arbitrary external websites by manipulating the return_to parameter. Attackers can craft malicious login URLs with unvalidated return_to values to conduct phishing attacks and steal user credentials.
Title Pachno 1.0.6 Open Redirection via return_to Parameter
First Time appeared Pachno
Pachno pachno
Weaknesses CWE-305
CPEs cpe:2.3:a:pachno:pachno:1.0.6:*:*:*:*:*:*:*
Vendors & Products Pachno
Pachno pachno
References
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N'}

cvssV4_0

{'score': 7.1, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N'}

Subscriptions

Pachno Pachno
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-04-13T18:10:55.592Z

Reserved: 2026-04-08T13:39:22.100Z

Link: CVE-2026-40039

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-04-13T19:16:51.447

Modified: 2026-04-13T19:16:51.447

Link: CVE-2026-40039

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-04-14T16:33:41Z

Weaknesses