CVE-2026-53683

Name of the Vulnerable Software and Affected Versions The product name cannot be determined (affected versions not specified)

Description The reset password.html page parses query string parameters and uses the url parameter as a redirection target via window.location = url following a password reset. This process can be optionally delayed by a delay parameter. Because no validation or allowlisting is performed on the url parameter, an attacker can redirect users to an arbitrary external site after the password-reset workflow is completed.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.