CVE-2026-40080: Cacti: Open Redirect via HTTP_REFERER substring check in auth_login_redirect
Cacti is an open source performance and fault management framework. Versions 1.2.30 and prior are vulnerable to Open Redirect through a substring check rather than a host check at strcontains($referer, CACTIPATHURL). When the user's loginopts == '1' (redirect to referer after login), the function used $SERVER['HTTPREFERER'] directly. An attacker could craft a referer such as https://evil.com/cacti/. Where CACTIPATHURL is /cacti/, the substring matches and the user is redirected to evil.com after login. The pre-existing validateredirecturl() helper at lib/htmlutility.php performed proper validation but was not invoked from authloginredirect(). This issue has been fixed in version 1.2.31.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Cactito a version that resolves this vulnerability.Fixed in 1.2.31 - Compensating control
If users can authenticate with login_opts == '1' (redirect to referer after login), restrict or block use of untrusted HTTP_REFERER values at the edge (e.g., via WAF/ACL) to prevent open-redirect behavior using substring matching of 'referer' containing '/cacti/' (CACTI_PATH_URL).
Event History
Frequently Asked Questions
What is the severity of CVE-2026-40080?
The severity of CVE-2026-40080 is rated medium with a score of 6.1.
How do I fix CVE-2026-40080?
To fix CVE-2026-40080, upgrade to Cacti version 1.2.31 or later.
What type of vulnerability is CVE-2026-40080?
CVE-2026-40080 is an Open Redirect vulnerability affecting Cacti.
Which versions of Cacti are affected by CVE-2026-40080?
Cacti versions 1.2.30 and prior are affected by CVE-2026-40080.
What does CVE-2026-40080 exploit involve?
CVE-2026-40080 exploits an inadequate check of the HTTP_REFERER for redirects after login.