CVE-2026-12379— URL Redirection to Untrusted Site ('Open Redirect') vulnerability in the Dashboard OAuth/OIDC implementation of Axivion
Possible ATT&CK Techniques 1AI
T1190 · Exploit Public-Facing ApplicationGet alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-12379
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in the Dashboard OAuth/OIDC implementation of Axivion
Source: CVE Program / CVE List V5
Vulnerability Description
An Open Redirect vulnerability (CWE-601) exists in the OAuth/OIDC authentication implementation of the Axivion Dashboard. The login flow did not properly restrict the post-authentication redirect to the application's own origin, so a user who follows a crafted login link can be sent to an untrusted external site after authenticating against the genuine Dashboard. Because the link points at the legitimate Dashboard, this can be abused for phishing, for example credential or second-factor theft via a convincing look-alike page. Exploitation requires the victim to follow the attacker-supplied link and complete the authentication flow.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/RE:M
Source: CVE Program / CVE List V5
Vulnerability Type
指向未可信站点的URL重定向(开放重定向)
Source: CVE Program / CVE List V5
Vulnerability Title
Qt Axivion 输入验证错误漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Qt Axivion是Qt公司的一款静态代码分析软件。 Qt Axivion存在输入验证错误漏洞，该漏洞源于OAuth/OIDC身份验证实现中存在开放重定向漏洞，登录流程未正确限制身份验证后重定向至应用程序自身源，可能导致用户跟随特制登录链接并在针对真实Axivion Dashboard进行身份验证后被重定向至不可信的外部网站，可被用于钓鱼攻击。以下版本受到影响：7.8.0及之前版本、7.9.0及之前版本、7.10.0及之前版本、7.11.0及之前版本和7.12.0及之前版本。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2026-12379
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-12379
请登录查看更多情报信息。
Vendor Pages for CVE-2026-12379 (1)
- 🔗 List of known vulnerabilities in Qt products - Qt Wikiissue-tracking
IV. Related Vulnerabilities
Same vendor: Qt
- CVE-2026-15037
XML injection vulnerability in QDom comment, CDATA and proce - CVE-2026-9499
Out-of-bounds read in QTextCodec::codecForName() in Qt - CVE-2026-12593
Privilege escalation via forged API token creation in Axivio - CVE-2025-14575
Uncontrolled Search Path Element in Qt Network OpenSSL TLS b - CVE-2026-6210
Type confusion and heap-buffer-overflow in Qt SVG marker han
Same weakness: CWE-601
- CVE-2026-18266
Dify AI Workflow oauth_redirect_url Open Redirect Vulnerabil - CVE-2026-67178
Open Redirect in MISP Installer-Generated Apache Configurati - CVE-2026-14171
ads-tec Industrial IT: Post-login open redirect in the web i - CVE-2026-53669
React Router: Open redirect via backslash in <Link> and useN - CVE-2026-53668
React Router: Open redirect can lead to XSS
V. Comments for CVE-2026-12379
No comments yet