Description
A vulnerability was found in a2ui-project a2ui up to 0.10.7. Affected by this issue is the function openUrl of the file renderers/web_core/src/v0_9/rendering/generic-binder.ts of the component Binder. The manipulation results in open redirect. It is possible to launch the attack remotely. The project was informed of the problem early through an issue report but has not responded yet.
Published: 2026-09-16
Score: 5.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Open Redirect
Action: Apply Fix
AI Analysis

Impact

A flaw in the Binder component users to arbitrary URLs. By supplying a crafted input, a remote actor can force the application to navigate to malicious sites, facilitating phishing or credential theft.

Affected Systems

The a2ui Project’s a2ui component, including the Binder module, in all releases up to and including 0.10.7 is affected.

Risk and Exploitability

The CVSS score of 5.3 reflects a medium severity vulnerability, while the EPSS score of less than 1% indicates a low probability of exploitation at present. The flaw is not listed in CISA’s KEV catalog. Attackers can exploit the issue remotely by invoking the vulnerable openUrl processing path without any authentication or additional controls. The risk is confined to redirects; it does not grant code execution or full system compromise.

Generated by OpenCVE AI on September 16, 2026 at 17:39 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade to a2ui release newer than 0.10.7 where the openUrl function has been patched.
  • If an upgrade remove use of openUrl or restrict its targets to a whitelisted set of domains.
  • Monitor application logs known malicious URLs.

Generated by OpenCVE AI on September 16, 2026 at 17:39 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 16 Sep 2026 19:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 16 Sep 2026 02:00:00 +0000

Type Values Removed Values Added
Description A vulnerability was found in a2ui-project a2ui up to 0.10.7. Affected by this issue is the function openUrl of the file renderers/web_core/src/v0_9/rendering/generic-binder.ts of the component Binder. The manipulation results in open redirect. It is possible to launch the attack remotely. The project was informed of the problem early through an issue report but has not responded yet.
Title a2ui-project a2ui Binder generic-binder.ts openUrl redirect
First Time appeared A2ui-project
A2ui-project a2ui
Weaknesses CWE-601
CPEs cpe:2.3:a:a2ui-project:a2ui:*:*:*:*:*:*:*:*
Vendors & Products A2ui-project
A2ui-project a2ui
References
Metrics cvssV2_0

{'score': 5, 'vector': 'AV:N/AC:L/Au:N/C:N/I:P/A:N/E:ND/RL:ND/RC:UR'}

cvssV3_0

{'score': 4.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:X/RL:X/RC:R'}

cvssV3_1

{'score': 4.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:X/RL:X/RC:R'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X'}

Subscriptions

A2ui-project A2ui
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-09-16T19:00:15.882Z

Reserved: 2026-09-15T18:29:09.149Z

Link: CVE-2026-92216

cve-icon Vulnrichment

Updated: 2026-09-16T18:53:56.661Z

cve-icon NVD

Status : Deferred

Published: 2026-09-16T02:17:38.827

Modified: 2026-09-16T19:18:05.257

Link: CVE-2026-92216

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-16T17:45:17Z

Weaknesses
  • CWE-601

    URL Redirection to Untrusted Site ('Open Redirect')