CVE-2026-93869

Name of the Vulnerable Software and Affected Versions Cotonti versions prior to 1.0.1

Description The software contains an open redirect issue within the cot url check() function. This occurs because the function uses a regular expression to validate redirect destinations that lacks an end-of-string anchor, allowing attackers to bypass the guard by providing hostnames that start with the site domain. This can be exploited through the ratings plugin or other redirect callers to send users to attacker-controlled hosts.

Recommendations Update Cotonti to a version newer than 1.0.0. As a temporary mitigation, restrict access to the ratings plugin until the update is applied.