CVE-2026-40080: Cacti Open Redirect in Authentication

Technical summary

The vulnerability stems from a flawed substring check in the auth_login_redirect() function. The code validates the HTTP_REFERER header using str_contains($referer, CACTI_PATH_URL)—a substring match rather than a proper host validation. An attacker-controlled URL like https://evil.com/cacti/ will match if CACTI_PATH_URL is /cacti/, causing the application to redirect authenticated users to the attacker's domain. Notably, Cacti already contained a proper validation function—validate_redirect_url()—in lib/html_utility.php, but it was never invoked during authentication redirects. This is a classic case of incomplete input validation leading to CWE-601 (URL Redirection to Untrusted Site).

Business impact

Open redirect vulnerabilities in login flows pose a direct phishing risk. Users trust the Cacti login page and may not notice a redirect to a lookalike or credential-harvesting site, particularly if the attacker uses similar branding. For organizations managing infrastructure via Cacti, a compromised admin session can expose sensitive monitoring data, historical metrics, and access to device management. The attack requires user interaction (clicking a crafted link) but can be distributed at scale via email or internal communication channels, making it an effective social engineering vector.

Affected systems

Cacti versions 1.2.30 and prior are affected. The vulnerability only manifests when the login_opts configuration is set to '1', which enables redirect-to-referer behavior. Organizations running default or explicitly configured referer-redirect authentication are at risk. Cacti installations used in enterprise monitoring environments—particularly those accessible to a wide user base or exposed to external networks—face higher exposure.

Exploitability

Exploitability is straightforward from a technical standpoint: an attacker needs only to craft a URL with a malicious referer header pointing to their domain while including a legitimate Cacti path substring. However, successful exploitation requires social engineering—the victim must click the malicious link and attempt to log in. There is no authentication bypass or remote code execution component; this is a redirect-based attack. The requirement for user interaction (clicking a link, entering credentials) and the visibility of browser address bar changes moderate the practical risk, but phishing campaigns leveraging this vector remain viable, especially in organizations where security awareness is lower.

Remediation

Upgrade to Cacti version 1.2.31 or later. This version corrects the authentication redirect logic to properly validate referer URLs before performing any redirect. If immediate patching is not feasible, organizations should disable the referer-redirect feature (login_opts != '1') to eliminate the attack vector. Additionally, review authentication logs and user sessions for unusual referer headers or unexplained redirects post-login.

Patch guidance

Apply the upgrade to version 1.2.31 or later. Verify compatibility with your current Cacti plugins and data source configurations before deploying to production. Standard Cacti upgrade procedures—backup the database, verify plugin compatibility, and test in a non-production environment—apply. No database schema changes or special migration steps are documented as part of this fix. After upgrade, confirm that the login_opts setting remains as intended and test the login flow with referer headers to ensure the redirect now properly validates the target domain.

Detection guidance

Monitor web server logs (access and referrer logs) for login attempts from suspicious referer headers, especially those containing attacker-controlled domains or unusual variations of your Cacti domain. Intrusion detection systems can flag HTTP_REFERER headers that do not match expected internal or trusted domains during authentication endpoints. Query Cacti access logs for redirect responses (HTTP 302 or 301) issued immediately after login POST requests. Review authentication and session logs for logins followed by suspicious outbound traffic or session anomalies. In WAF/proxy logs, look for login paths with referer headers pointing to external domains.

Why prioritize this

This vulnerability warrants prompt patching due to its position in the authentication flow and the direct phishing risk it creates. While the CVSS score of 6.1 reflects the requirement for user interaction, the attack surface is broad in organizations with many Cacti users. The fix is simple and low-risk, making this an ideal candidate for near-term patching cycles. Prioritize systems where Cacti is user-facing (multiple users) or exposed to untrusted networks over isolated single-user installations.

Risk score, explained

The CVSS 3.1 score of 6.1 (MEDIUM) reflects a network-accessible vulnerability with low attack complexity but requiring user interaction and affecting confidentiality and integrity rather than availability. The score appropriately penalizes the phishing requirement but does not fully capture the damage potential in a social engineering context. For security leaders, contextualize this as higher-risk in user-facing Cacti deployments and lower-risk in air-gapped or single-admin environments.

Frequently asked questions