CVE-2026-45566: Roxy-WI: Open redirect on /login?next= via basic-auth userinfo syntax bypass
Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. In versions 8.2.6.4 and prior, the login flow allow-lists next URLs by rejecting strings containing https:// or http:// substrings, then constructs https://{request.host}{nexturl} and the JS client redirects via window.location.replace(). The block does not consider the userinfo@host syntax. next=@evil.example/path produces https://victim.example@evil.example/path, which all modern browsers route to evil.example. At time of publication, there are no publicly available patches.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Remove
Remove
roxy-wifrom your environment.If Roxy-WI is not required, uninstall or disable the Roxy-WI service to eliminate exposure to the open-redirect vulnerability until an official fix is provided.
- Configuration
Validate and canonicalize the 'next' parameter on the server: require it to be an absolute path beginning with '/' (no scheme or host), explicitly reject or strip any userinfo ('user@host') or '@' characters and any embedded host or scheme, and construct redirects only from the sanitized path (do not rely on client-side concatenation that allows userinfo bypasses).
Roxy-WI login flow next_url validation = require path-only (absolute-path) and disallow userinfo/host parts (no '@') - Compensating control
Until an upstream patch is available, restrict access to the Roxy-WI administrative interface using network controls (firewall, ACLs, VPN, or WAF) to trusted IPs or networks to reduce exposure to remote attackers.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-45566?
CVE-2026-45566 has a medium severity rating of 6.1.
How do I fix CVE-2026-45566?
To fix CVE-2026-45566, update Roxy-WI to version 8.2.6.5 or later.
What type of vulnerability is CVE-2026-45566?
CVE-2026-45566 is an open redirect vulnerability that allows bypassing security restrictions in the login flow.
Which software is affected by CVE-2026-45566?
CVE-2026-45566 affects Roxy-WI versions 8.2.6.4 and prior.
What impact does CVE-2026-45566 have on users?
CVE-2026-45566 could allow an attacker to redirect users to malicious sites or phishing pages.