CVE-2026-66414

Name of the Vulnerable Software and Affected Versions Leantime version 3.6.2

Description An open redirect issue exists in the Login controller. Unauthenticated attackers can redirect authenticated users to arbitrary external sites by manipulating the redirectUrl POST parameter. This is achieved by crafting a malicious login URL with a tampered redirectUrl value that bypasses the FILTER SANITIZE URL validation, potentially leading to phishing or credential theft.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.