CVE-2026-73671
Received Received - Intake

Unauthenticated Open Redirect in Saurus CMS Community Edition

Publication date: 2026-08-13

Last updated on: 2026-08-13

Assigner: VulnCheck

Description
Saurus CMS Community Edition contains an unauthenticated open redirect vulnerability in the logout handling code in classes/port.inc.php, where the url parameter supplied via GET or POST is passed directly to the Location header without domain allowlist, scheme validation, or relative path enforcement. Attackers can craft a malicious logout URL containing an arbitrary external domain or javascript: URI scheme to redirect authenticated users to attacker-controlled phishing pages after session destruction, enabling credential theft and OAuth redirect abuse.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-13
Last Modified
2026-08-13
Generated
2026-08-13
AI Q&A
2026-08-13
EPSS Evaluated
N/A
NVD
CVE-2026-73671
EUVD
EUVD-2026-58111

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
saurus cms_community_edition *
saurus_cms community_edition to 4.7.FINAL (exc)
saurus_cms community_edition to d886e5b (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-601 The web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a redirect.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an unauthenticated open redirect flaw in Saurus CMS Community Edition versions up to 4.7.FINAL. It exists in the logout handling code where the 'url' parameter is passed directly to the Location header without validation. Attackers can manipulate this to redirect users to malicious external domains or javascript: URIs after logout, enabling phishing attacks and credential theft.

Detection Guidance
  • Check Saurus CMS Community Edition version 4.7.FINAL or earlier for the vulnerable classes/port.inc.php file.
  • Inspect HTTP requests to logout endpoints for url parameters containing external domains or javascript: URIs.
  • Use tools like Burp Suite or OWASP ZAP to intercept and modify logout requests, testing for open redirect behavior.
  • Search server logs for suspicious redirect patterns after logout actions.
Impact Analysis

If exploited, this vulnerability allows attackers to redirect users to phishing sites after logout, tricking them into entering credentials. It can also enable OAuth redirect abuse and session hijacking. Users may unknowingly expose sensitive information to attackers.

Compliance Impact

This vulnerability could lead to unauthorized access to user data, violating GDPR's data protection principles and HIPAA's security requirements for safeguarding sensitive information. Organizations may face compliance penalties if user data is compromised through such attacks.

Mitigation Strategies
  • Update Saurus CMS to the latest version that patches the open redirect issue.
  • Implement input validation to reject absolute URLs in the url parameter, allowing only relative paths.
  • Add domain allowlist checks for the url parameter before processing redirects.
  • Disable or restrict direct access to logout endpoints until patched.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-73671. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart