CVE-2026-128637: Open Redirect in MISP Modules Website Login via Unvalidated next Parameter
The MISP Modules website component contains an open redirect vulnerability in its login endpoint. The /login route accepted a user-supplied next query parameter and passed it directly to Flask's redirect() function without validating the destination. An attacker could craft a URL such as https://victim-host/login?next=https://attacker.example/phish and deliver it to a user (e.g., via email or a lookalike page). After the user successfully authenticated, the application issued a 302 redirect to the attacker-controlled external URL. This enables phishing attacks where a user, believing they are still on the legitimate MISP Modules site, may enter additional credentials or sensitive information on the attacker's page. It can also be used to obscure the true destination of a link, bypassing user trust in the legitimate domain. The vulnerability requires the victim to interact with the crafted URL and complete a login, but no prior authentication or special configuration is needed on the attacker's side. The affected component is the website sub-project of misp-modules, specifically the account blueprint in website/app/account/account.py. No version boundaries are specified in the patch metadata.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
In website/app/account/account.py, validate the /login next parameter with a _safe_next_url() function: allow only local paths or same-host HTTP(S) URLs, normalize same-host URLs to relative paths while preserving query strings and fragments, and reject empty targets, backslashes, control characters, leading or trailing whitespace, unrecognized schemes, mismatched hosts, and protocol-relative URLs.
Event History
Frequently Asked Questions
Who can be targeted by this issue?
Users of the MISP Modules website component who can be persuaded to open an attacker-crafted login URL and then successfully log in can be redirected to an external attacker-controlled site. The attacker does not need prior authentication or special configuration.
Does exploitation require user interaction?
Yes. The victim must follow a crafted URL containing a malicious next parameter and complete the login process before the external redirect occurs.
Which part of the project is affected?
The affected component is the website sub-project of misp-modules, specifically the account blueprint implementation in website/app/account/account.py. The issue is in the /login route's handling of the next query parameter.
Are affected version ranges available?
No. The provided patch information does not specify affected or fixed version boundaries.