CVE-2026-10861

Name of the Vulnerable Software and Affected Versions MISP (affected versions not specified)

Description An open redirect occurs in the routeafterlogin() function of the UsersController because the value stored in the pre login requested url session key is used as the post-login redirect destination without sufficient verification that it is a local application path. An unauthenticated remote attacker can craft a link that directs a victim to a trusted MISP instance; upon successful authentication, the victim is redirected to an external URL controlled by the attacker. This can be used to facilitate phishing attacks, redirect users to counterfeit login pages, or deliver malicious content from an untrusted domain.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.