CVE-2026-46616

Name of the Vulnerable Software and Affected Versions Umbraco versions prior to 13.14.0 Umbraco versions prior to 17.4.0

Description Certain Surface Controllers supporting member-related operations fail to validate redirect URLs. This allows Razor templates that derive the RedirectUrl from user-controlled query parameters to be susceptible to malicious redirect attacks. The issue specifically affects the UmbLoginStatusController, UmbProfileController, and UmbRegisterController controllers.

Recommendations Update to version 13.14.0. Update to version 17.4.0. As a temporary workaround, ensure every Razor form posting to UmbLoginStatusController, UmbProfileController, or UmbRegisterController passes a concrete, trusted RedirectUrl into the route values of Html.BeginUmbracoForm.