CVE-2026-14171
Received Received - Intake

Unauthenticated Open Redirect in Web-UI

Publication date: 2026-07-28

Last updated on: 2026-07-28

Assigner: CERT VDE

Description
An unauthenticated remote attacker can abuse the improper validation of the post-login redirect of the web-UI to trick users to a malicious website. This can result in a loss of confidentiality and availability.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-28
Last Modified
2026-07-28
Generated
2026-07-28
AI Q&A
2026-07-28
EPSS Evaluated
N/A
NVD
CVE-2026-14171
EUVD
EUVD-2026-49731

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-601 The web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a redirect.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability allows an unauthenticated remote attacker to manipulate the post-login redirect feature in the web interface. By tricking users into following a malicious link, the attacker can redirect them to a harmful website, potentially compromising their data or system access.

Impact Analysis

This vulnerability can lead to loss of confidentiality and availability. Attackers may steal sensitive information or disrupt access to critical services by redirecting users to malicious sites.

Mitigation Strategies

Implement strict input validation for the post-login redirect parameter to ensure it only allows trusted URLs. Configure the web application to reject or sanitize any redirect URLs that point to external domains. Regularly update and patch the web application to address known vulnerabilities.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-14171. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart