CVE-2026-28301: Open Redirect Vulnerability (MEDIUM CVSS 4.8)

Technical summary

This vulnerability implements an Open Redirect (CWE-601) flaw where insufficient input validation on external URLs allows an attacker to redirect authenticated users to arbitrary websites. The CVSS 3.1 vector (AV:A/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N) indicates the attack requires adjacent network access and high attack complexity, but once triggered, achieves high confidentiality impact. The absence of user interaction (UI:N) in the vector suggests the redirect executes automatically or through an unexpected mechanism, distinguishing this from typical phishing redirects that rely on user clicks.

Business impact

The primary business risk stems from potential information disclosure through forced redirection to attacker-controlled sites that can harvest credentials, capture session tokens, or exfiltrate sensitive data. The requirement for authenticated user access limits the attack surface to internal personnel or trusted partners. Organizations should assess whether their users routinely follow URLs from potentially untrusted sources within their trusted infrastructure, as this affects real-world exploitation likelihood.

Affected systems

The source data does not specify affected vendors or products. Organizations should cross-reference this CVE identifier with their vendor security bulletins and software bill of materials to determine exposure. Verify whether any systems in your environment that process or forward external URLs are vulnerable to open redirect attacks.

Exploitability

This vulnerability has a CVSS exploitability score reflecting moderate difficulty. The attacker must establish adjacent network access and the victim must have valid system credentials, raising the bar above purely external attacks. However, the high attack complexity mitigating factor suggests the technique may require specific conditions or configurations. The vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, indicating active exploitation in the wild has not been confirmed as of the publication date.

Remediation

Remediation should focus on input validation and URL sanitization. Implement strict allowlisting of permitted redirect destinations rather than blacklisting malicious patterns. Any external URL parameter should be validated against a known-good set of domains before processing. Additionally, review authentication token handling to ensure tokens cannot be harvested during redirects. Consult vendor security advisories for patch availability and specific remediation steps for your affected products.

Patch guidance

Check your vendor's security advisory website directly for patched versions and deployment timelines. Given the MEDIUM severity and lack of KEV listing, patching should be prioritized according to your organization's standard change management schedule, but should not be deferred indefinitely. Verify patch compatibility with your environment before production deployment. If your vendor has not issued a patch, implement compensating controls such as URL filtering or network segmentation to reduce exposure.

Detection guidance

Monitor for HTTP 302/301 redirect responses that forward authenticated sessions to external domains outside your allowlisted destination set. Log and alert on URL parameters that contain encoded or manipulated domain references. Endpoint detection systems should flag requests to known-attacker infrastructure domains that may be redirection targets. Review web proxy and firewall logs for unusual redirect patterns initiated from internal users on the affected system.

Why prioritize this

While the CVSS score is MEDIUM (4.8) and the vulnerability requires adjacent network access plus user credentials, the high confidentiality impact and potential for silent data exfiltration warrant attention. The lack of active exploitation (no KEV listing) allows time for deliberate patching, but organizations should not treat this as low-risk. Prioritize based on whether your environment meets the attack prerequisites: adjacent network access and the presence of authenticated users who may follow external links.

Risk score, explained

The score of 4.8 reflects the combination of high confidentiality impact offset by stringent access requirements. Adjacent network access (AV:A) and high attack complexity (AC:H) reduce exploitability compared to network-based attacks. The requirement for low privileges (PR:L) further narrows the attacker pool. However, the confidentiality impact rating remains high (C:H), preventing a lower overall score. This is appropriately classified as MEDIUM risk rather than HIGH, suitable for organizations with mature access controls and network segmentation.

Frequently asked questions