CVE-2026-100523: Cotonti through 1.0.0 Open Redirect via message.php redirect parameter
Cotonti through 1.0.0 contains an open redirect vulnerability in message.php that base64-decodes the redirect parameter without domain validation. Unauthenticated attackers can craft malicious links with encoded external URLs to redirect users to arbitrary sites via meta refresh tags for phishing attacks.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker does not need to authenticate. Exploitation requires convincing a user to follow a crafted link containing a base64-encoded external URL in the redirect parameter.
What is the practical impact?
Affected installations can be used as a trusted-looking redirector to send users to arbitrary external sites. The described use case is phishing through the page's meta refresh redirect.
How can I determine whether an installation is affected?
The issue applies to Cotonti through version 1.0.0. Check whether message.php accepts the redirect parameter, base64-decodes it, and redirects without validating that the destination belongs to an approved domain.