CVE-2026-128637
Deferred Deferred - Pending Action

Open Redirect in MISP Modules Website

Publication date: 2026-11-13

Last updated on: 2026-11-13

Assigner: CIRCL

Description
The MISP Modules website component contains an open redirect vulnerability in its login endpoint. The /login route accepted a user-supplied next query parameter and passed it directly to Flask's redirect() function without validating the destination. An attacker could craft a URL such as https://victim-host/login?next=https://attacker.example/phish and deliver it to a user (e.g., via email or a lookalike page). After the user successfully authenticated, the application issued a 302 redirect to the attacker-controlled external URL. This enables phishing attacks where a user, believing they are still on the legitimate MISP Modules site, may enter additional credentials or sensitive information on the attacker's page. It can also be used to obscure the true destination of a link, bypassing user trust in the legitimate domain. The vulnerability requires the victim to interact with the crafted URL and complete a login, but no prior authentication or special configuration is needed on the attacker's side. The affected component is the website sub-project of misp-modules, specifically the account blueprint in website/app/account/account.py. No version boundaries are specified in the patch metadata.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-13
Last Modified
2026-11-13
Generated
2026-11-13
AI Q&A
2026-11-13
EPSS Evaluated
N/A
NVD
CVE-2026-128637
EUVD
EUVD-2026-124875

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
misp misp-modules From 0 (inc) to 3.1.4 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-601 The web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a redirect.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an open redirect flaw in the MISP Modules website. The login endpoint accepts a user-controlled 'next' parameter and uses it in a redirect without validation. Attackers can craft URLs that redirect users to malicious sites after login, tricking them into entering credentials or sensitive data on fake pages.

Detection Guidance

To detect this vulnerability, monitor web server logs for suspicious login attempts with external URLs in the next parameter. Check for redirects to domains other than your own after successful logins. Use tools like curl to test if the /login endpoint accepts and redirects to arbitrary URLs.

Impact Analysis

If you click a malicious link, you may be redirected to a phishing site after logging in. This could lead to credential theft, exposure of sensitive information, or further compromise of your account or system. The attack requires user interaction but no prior authentication.

Mitigation Strategies

Apply the patch from the provided commit which restricts post-login redirects to local paths only. Update the website README and login logic in account.py to use the new _safe_next_url function. Test the changes with the included test file login_checks.py to ensure proper validation.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-128637. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...