CVE-2026-112040
Received Received - Intake

Open Redirect in Diem Project Sign-In Component

Publication date: 2026-10-19

Last updated on: 2026-10-19

Assigner: VulDB

Description
A vulnerability was determined in diem-project diem up to 116974edfb9a5b8bd69cb13586dc62bcdbb485ad. This affects an unknown part of the file dmCorePlugin/plugins/dmUserPlugin/modules/dmUser/lib/BasedmUserActions.class.php of the component Sign-In. This manipulation of the argument Referer causes open redirect. The attack is possible to be carried out remotely. The exploit has been publicly disclosed and may be utilized. This product adopts a rolling release strategy to maintain continuous delivery. Therefore, version details for affected or updated releases cannot be specified. The project was informed of the problem early through an issue report but has not responded yet.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-19
Last Modified
2026-10-19
Generated
2026-10-19
AI Q&A
2026-10-19
EPSS Evaluated
N/A
NVD
CVE-2026-112040
EUVD
EUVD-2026-104043

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
diem-project diem 116974edfb9a5b8bd69cb13586dc62bcdbb485ad

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-601 The web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a redirect.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an open redirect issue in the Diem project. It occurs because the application saves the HTTP Referer header before user authentication and uses it unvalidated to redirect users after login. This allows attackers to redirect users to malicious domains after they log in, enabling phishing attacks.

Detection Guidance

Check for open redirect patterns in authentication flows by inspecting HTTP Referer headers. Look for unvalidated redirects in BasedmUserActions.class.php and BasedmUserAdminActions.class.php. Monitor network traffic for suspicious post-authentication redirects to external domains.

Impact Analysis

An attacker could trick you into clicking a malicious link, leading you to log in on the legitimate site before redirecting you to a fake site. This could expose you to phishing attacks, where attackers may steal sensitive information or install malware.

Compliance Impact

This vulnerability enables open redirect attacks, which could facilitate phishing campaigns. Such attacks may lead to unauthorized access to user credentials or sensitive data, potentially violating GDPR's data protection principles or HIPAA's security requirements for protected health information.

Mitigation Strategies

Validate and sanitize the Referer header before using it for redirects. Implement strict host-based allowlists for post-authentication redirects. Update to the latest version of Diem if available. Monitor for phishing attempts exploiting this vector.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-112040. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart