CVE-2026-40080

Name of the Vulnerable Software and Affected Versions Cacti versions prior to 1.2.31

Description An open redirect issue exists due to the use of a substring check instead of a host check within the str contains($referer, CACTI PATH URL) logic. When the login opts variable is set to '1', the auth login redirect() function directly utilizes the $ SERVER['HTTP REFERER'] variable. An attacker can exploit this by crafting a referer containing the CACTI PATH URL substring, such as https://evil.com/cacti/, causing the user to be redirected to an external malicious site after login. This occurs because the validate redirect url() helper function in lib/html utility.php, which provides proper validation, was not called by the auth login redirect() function.

Recommendations Update to version 1.2.31.