CVE-2026-100523

Name of the Vulnerable Software and Affected Versions Cotonti versions prior to 1.0.1

Description An open redirect issue exists in the 'message.php' endpoint. The application base64-decodes the redirect parameter without performing proper domain validation. This allows unauthenticated attackers to create malicious links containing encoded external URLs, which can redirect users to arbitrary websites using meta refresh tags, potentially facilitating phishing attacks.

Recommendations Update Cotonti to a version newer than 1.0.0. As a temporary mitigation, restrict access to the 'message.php' endpoint or avoid using the redirect parameter until a patch is applied.