CVE-2026-73734: Unauthenticated Open Redirect allows URL Manipulation in HPE Networking Fabric Composer Web Interface
A vulnerability in the web-based management interface of HPE Networking Fabric Composer could allow an unauthenticated remote attacker to redirect users to an arbitrary URL.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Users of the HPE Networking Fabric Composer web-based management interface are exposed if they can be induced to follow a crafted redirect through the interface. The vulnerability can be triggered remotely without authentication.
What does an attacker need to exploit it?
The attacker does not need an account or other privileges, and exploitation has low complexity. However, user interaction is required, meaning the attacker must cause a user to follow the manipulated URL.
What is the likely impact of successful exploitation?
Successful exploitation can redirect a user to an arbitrary URL. The supplied severity vector indicates low confidentiality and integrity impact, with no availability impact.