CVE-2026-45566

Name of the Vulnerable Software and Affected Versions Roxy-WI versions prior to 8.2.6.5

Description The login flow fails to properly validate the next parameter when constructing a redirect URL. The system attempts to prevent open redirects by rejecting strings containing http:// or https://, but it does not account for the userinfo@host syntax. An attacker can use a value such as @evil.example/path in the next parameter, which results in a URL formatted as https://{request.host}@evil.example/path. Modern browsers interpret this as a request to the external domain evil.example, leading to an open redirect via the window.location.replace() function.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.