CVE-2026-10861— MISP post-login open redirect via pre_login_requested_url

MISP post-login open redirect via pre_login_requested_url

An open redirect vulnerability existed in MISP UsersController::routeafterlogin() because the value stored in the pre_login_requested_url session key was used as the post-login redirect destination without sufficiently enforcing that it was a local application path. An unauthenticated remote attacker could craft a link that causes a victim to visit a trusted MISP instance and, after successful authentication, be redirected to an attacker-controlled external URL. This could be abused to increase the credibility of phishing attacks, redirect users to counterfeit login pages, or deliver attacker-controlled content from an untrusted domain. CWE-601 describes this weakness as accepting user-controlled input that specifies an external link and using it in a redirect, with phishing as a common consequence. The patch mitigates the issue by decoding and parsing the URL, rejecting URLs with a scheme, host, user component, missing or non-local path, and protocol-relative forms such as //example.com and /\example.com.

N/A

指向未可信站点的URL重定向(开放重定向)

MISP 安全漏洞

MISP是MISP开源的一套开源的软件解决方案。该产品用于收集、存储、分发、共享网络安全指标，并具有威胁网络安全事件分析和恶意软件分析等功能。 MISP存在安全漏洞，该漏洞源于UsersController::routeafterlogin()中存储的pre_login_requested_url会话键值被用作登录后重定向目标，且未充分验证其为本地应用路径，可能导致未经验证的远程攻击者构造链接，诱使受害者访问受信任的MISP实例并在成功认证后重定向至攻击者控制的外部URL。

N/A

N/A