CVE-2026-33213

Name of the Vulnerable Software and Affected Versions Redash versions 5.0.2 through 26.3.0

Description The authentication module contains an issue where the get next path() function fails to normalize multiple leading slashes in the next parameter. While the function removes the scheme and network location, it does not account for multiple slashes, which allows an attacker to use a crafted URL at the '/login' endpoint to redirect users to an external site after they authenticate.

Recommendations Update Redash to a version later than 26.3.0. As a temporary mitigation, restrict or validate the next parameter used in the '/login' endpoint to prevent the use of multiple leading slashes.