Open Redirect in nforwardauth Service

Executive Summary

CVE-2026-81509 is an open redirect vulnerability in nforwardauth, a forward auth service. It allows unauthenticated attackers to craft malicious URLs with an unvalidated 'r' query parameter on the /login endpoint. After a victim authenticates, the service redirects them to an attacker-controlled website, enabling phishing or social-engineering attacks. The vulnerability does not bypass authentication but exploits trust in the legitimate domain.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, inspect your nforwardauth application logs for suspicious redirect URLs containing the 'r' parameter in the /login endpoint. Check for redirects to external domains after authentication. You can also review the application code for unvalidated use of the 'r' parameter in redirect logic.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability could trick users into visiting malicious sites after logging in, potentially stealing credentials or installing malware. Attackers may impersonate legitimate services to deceive victims. While it doesn't bypass authentication, it undermines trust in the service's domain.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade to nforwardauth version 1.5.1 or later immediately. Validate the 'r' parameter to accept only trusted or local paths, rejecting foreign absolute URLs. Ensure both server-side and client-side redirects enforce this validation.

Useful 0 Not Useful 0