CVE-2026-58450: Invoice Ninja Open Redirect in Client Portal Login

Technical summary

The vulnerability stems from improper validation of the 'intended' query parameter in the client portal login flow. The ContactLoginController authenticated() handler accepts and stores the 'intended' parameter without validating that it points to the same host as Invoice Ninja. During login, this parameter is used to determine where to redirect the user post-authentication. An attacker can inject an external URL into this parameter, which the application preserves in the session and later uses for a bare redirect() call without any host-origin checks. This is a classic Open Redirect (CWE-601) that leverages the trust users place in legitimate login pages to bypass browser security warnings.

Business impact

For Invoice Ninja customers, this vulnerability creates a reputational and operational risk. Attackers can craft phishing emails that appear to redirect to legitimate Invoice Ninja client login pages, but instead funnel authenticated users to credential-harvesting sites or drive-by downloads. Customers may lose confidence in the platform's security, especially if breached credentials are misused. For managed service providers and accountants relying on Invoice Ninja for client operations, compromise could extend to downstream customers and business relationships. The medium severity reflects that user interaction (clicking a phishing link) is required, but the attack surface is broad and the impact is meaningful.

Affected systems

Invoice Ninja through version 5.13.26 is vulnerable. The flaw exists in the client portal login flow, affecting both self-hosted and cloud deployments. No patch version or release date is provided in this advisory; verify the current version of Invoice Ninja in your environment and confirm availability of a patched release through the vendor's official channels.

Exploitability

Exploitability is straightforward from an attacker perspective but requires social engineering to succeed. An attacker needs only to craft a URL with a malicious 'intended' parameter and distribute it via phishing. No special privileges, authentication, or technical barriers prevent the attack. However, the attack depends on user interaction—the victim must click the link and complete a legitimate login. Browser-based protections may offer minimal defense since the redirect occurs after successful authentication to a legitimate domain, lowering user suspicion. The vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.

Remediation

Update Invoice Ninja to a patched version beyond 5.13.26. The remediation requires adding host validation logic to the 'intended' parameter before using it for redirection. Developers should implement a whitelist check or URL parser that ensures the redirect target is relative or belongs to the same origin. As an interim mitigation, consider restricting login access by IP or implementing additional authentication factors (multi-factor authentication) to reduce phishing effectiveness.

Patch guidance

Check the Invoice Ninja GitHub releases and official security advisories for versions after 5.13.26. Apply the latest available patch from the vendor. If you maintain a self-hosted instance, ensure your update process includes any database migrations or configuration changes. Cloud-hosted customers should verify that the platform has been automatically updated and confirm the version in your account settings.

Detection guidance

Monitor for suspicious redirect patterns in application logs, particularly any 'intended' parameter values that reference external domains or unexpected hosts. Web application firewalls can be configured to flag or block redirect attempts to non-whitelisted domains. In network traffic, look for authentication events followed by redirects to domains outside your organization. User education on phishing is critical—encourage staff to verify the URL in their browser location bar after login and report any unexpected redirects. Consider implementing a web proxy that can inspect and block malicious redirects client-side.

Why prioritize this

Although the CVSS score is 4.3 (Medium), prioritize patching based on your organization's phishing resilience and user awareness training. If your workforce is frequently targeted by social engineering or if Invoice Ninja is critical to billing operations, elevation to high priority is justified. The attack is user-dependent but requires no attacker credentials, making it a persistent and low-friction threat vector. The lack of KEV status indicates limited real-world exploitation at scale (as of the advisory date), but that should not delay patching.

Risk score, explained

The CVSS 3.1 score of 4.3 reflects a network-accessible vulnerability (AV:N) that requires no special privileges (PR:N) and is easy to trigger (AC:L), but mandates user interaction (UI:R). The scope is unchanged (S:U), meaning the attacker cannot escalate to other systems through the redirect itself. Confidentiality impact is low (C:L)—the attacker gains access to the authenticated user's session but does not necessarily compromise data within Invoice Ninja. Integrity and availability are not compromised (I:N, A:N) because the redirect does not modify Invoice Ninja data or its availability. The score is conservative relative to business risk because it does not account for downstream phishing or credential theft on attacker-controlled sites.

Frequently asked questions