CVE-2026-55840

Deferred Deferred - Pending Action

Authentication Bypass via Malicious Redirect in Scoold

Publication date: 2026-10-15

Last updated on: 2026-10-15

Assigner: GitHub, Inc.

Description

Scoold is a Q&A and a knowledge sharing platform for teams. Prior to 1.69.1, the getBackToUrl() method in src/main/java/com/erudika/scoold/utils/HttpUtils.java validates the backto and returnto parameters with Strings.CI.startsWith against the configured server URL. An attacker can supply an absolute URL whose hostname begins with the legitimate hostname, causing URI.resolve() to retain the attacker URL and the prefix check to accept it. A victim who follows the crafted sign-in link can be redirected to an attacker-controlled domain after authentication, enabling phishing and possible credential or token theft. This issue is fixed in version 1.69.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-15

Last Modified

2026-10-15

Generated

2026-10-19

AI Q&A

2026-10-16

EPSS Evaluated

2026-10-18

NVD

CVE-2026-55840

EUVD

EUVD-2026-102312

Affected Vendors & Products

Vendor	Product	Version / Range
Erudika	scoold	< 1.69.1

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-601	The web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a redirect.

Attack-Flow Graph

Executive Summary

This is an open redirect vulnerability in Scoold versions before 1.69.1. The getBackToUrl() method validates redirect URLs using a case-insensitive startsWith check against the server URL. Attackers can craft a URL with a hostname beginning with the legitimate domain (e.g., scoold.example.com.attacker.com) to bypass validation. The URI.resolve() function retains the attacker URL while the prefix check accepts it, redirecting victims to attacker-controlled domains after authentication.

Detection Guidance

Check Scoold application logs for suspicious redirect URLs containing domains starting with your server's domain. Inspect HTTP responses for 'Location' headers with attacker-controlled domains. Use tools like curl to test URLs with crafted backto or returnto parameters for unexpected redirects.

Impact Analysis

Victims clicking a malicious sign-in link may be redirected to an attacker-controlled domain after authentication. This enables phishing attacks to steal credentials or tokens. The vulnerability requires user interaction but can lead to unauthorized access to sensitive data or account compromise.

Compliance Impact

This vulnerability could indirectly impact compliance with GDPR and HIPAA by enabling phishing attacks that steal credentials or tokens. Under GDPR, unauthorized data access due to phishing may violate Article 32 (security of processing). HIPAA requires safeguards against unauthorized access (45 CFR 164.308(a)(1)(ii)(B)), which phishing could undermine.

Mitigation Strategies

Upgrade Scoold to version 1.69.1 or later. Review and restrict access to the getBackToUrl function. Implement strict URL validation for redirect parameters. Monitor authentication flows for unusual redirect patterns.

Hi! I’m here to help you understand CVE-2026-55840. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70