CVE-2026-41513: Horilla: Open Redirect via Unvalidated `next` Parameter in Notification Endpoints

Published May 12, 2026

Updated

Horilla is an HR and CRM software. In 1.5.0, the notification endpoints trust the unvalidated next parameter and redirect users to arbitrary external URLs. This allows an attacker to turn trusted application links into phishing or social-engineering redirects.

Affected Software

1 affected component

Horilla horilla=1.5.0

Event History

May 12, 2026

CVE Published

via MITRE·04:43 PM

Data Sourced

via MITRE·04:43 PM

DescriptionWeakness

Data Sourced

via NVD·06:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What is the severity of CVE-2026-41513?

CVE-2026-41513 has a high severity due to its potential for exploitation through open redirection.

How do I fix CVE-2026-41513?

To fix CVE-2026-41513, validate and sanitize the next parameter in your notification endpoints to prevent arbitrary redirects.

Which versions of Horilla are affected by CVE-2026-41513?

CVE-2026-41513 affects Horilla version 1.5.0.

Can CVE-2026-41513 lead to phishing attacks?

Yes, CVE-2026-41513 can allow attackers to redirect users to malicious sites, making them susceptible to phishing attacks.

What is an open redirect vulnerability like CVE-2026-41513?

An open redirect vulnerability, such as CVE-2026-41513, occurs when a web application accepts unvalidated input and redirects users to external URLs, leading to potential misuse.