Cacti 1.2.30 and earlier contains an open‑redirect flaw in the login redirect logic. When the login option is set to redirect to the HTTP_REFERER after successful authentication, the code uses a simple substring check against the configured Cacti path rather than a full host validation. An attacker can set a referer such as https://evil.com/cacti/; because the substring '/cacti/' is present, the redirect logic treats the URL as internal and sends the authenticated user to the malicious site, enabling phishing, credential theft, or other social‑engineering attacks.

The vulnerability affects the open source performance and fault management framework Cacti, specifically versions 1.2.30 and all earlier releases. The issue was fixed in version 1.2.31, which implements proper host validation for redirects.

The flaw carries a CVSS score of 6.1, indicating moderate severity. Although an EPSS score is not available and the vulnerability is not listed in CISA’s KEV catalog, the attack path is straightforward: an attacker who can influence the HTTP_REFERER header of a logged‑in user can redirect that user to an arbitrary external site. The potential impact on confidentiality, integrity, or availability is limited to credential compromise or defacement via phishing, but the ease of exploitation and the possibility of mass targeting of users elevate the overall risk to a moderate level.