CVE-2024-58389

Received Received - Intake

Open Redirect in HoloViz Panel

Publication date: 2026-10-12

Last updated on: 2026-10-12

Assigner: VulnCheck

Description

HoloViz Panel from 1.2.2 before 1.9.0 contains an open redirect vulnerability in panel/auth.py that allows remote attackers to redirect users by supplying an unvalidated next query parameter. BasicLoginHandler and PasswordLoginHandler store the parameter in a next_url cookie, so crafted login links send victims to attacker-controlled external sites after successful login.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-12

Last Modified

2026-10-12

Generated

2026-10-13

AI Q&A

2026-10-13

EPSS Evaluated

N/A

NVD

CVE-2024-58389

Affected Vendors & Products

Vendor	Product	Version / Range
HoloViz	Panel	1.2.2

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-601	The web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a redirect.

Attack-Flow Graph

Executive Summary

HoloViz Panel versions from 1.2.2 to 1.9.0 have an open redirect vulnerability in panel/auth.py. Attackers can manipulate the next query parameter to redirect users to malicious external sites after login. The BasicLoginHandler and PasswordLoginHandler store this parameter in a next_url cookie, enabling crafted login links to send victims to attacker-controlled destinations.

Detection Guidance

Check for unusual login URLs or redirects in web server logs. Inspect cookies named next_url in responses from HoloViz Panel login endpoints. Monitor for external site redirections after successful authentication.

Impact Analysis

This vulnerability allows attackers to trick users into visiting malicious websites after a successful login. Users may unknowingly enter credentials or sensitive data on fake sites controlled by attackers, leading to phishing attacks, credential theft, or malware infections.

Compliance Impact

This vulnerability could lead to unauthorized data exposure or phishing attacks, potentially violating GDPR's data protection requirements or HIPAA's safeguards for protected health information. Organizations may face compliance penalties if user data is compromised due to this flaw.

Mitigation Strategies

Upgrade HoloViz Panel to version 1.9.0 or later. Validate and sanitize the next query parameter in panel/auth.py to prevent open redirect attacks. Review and restrict cookie usage for login handlers.

Hi! I’m here to help you understand CVE-2024-58389. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70