CVE-2026-86351: MISP User Homepage Validation Allows Authenticated Open Redirect via Protocol-Relative URL
Affected versions of MISP validate the user-configurable homepage by checking only whether the supplied path begins with /. That check is insufficient because protocol-relative URLs such as //attacker.example also begin with / but resolve to an external origin in browsers.
The vulnerable homepage value can be stored as a user setting and later used by the post-login routing logic. The commit explicitly identifies //attacker.example as a payload that passed validation and was emitted to the Location header after login.
The fix introduces a shared InternalRedirectValidator that rejects URLs containing a host, scheme, userinfo, unsafe leading // or /\, malformed URLs, and control characters. It also revalidates homepage settings on read so legacy or internally written unsafe values cannot bypass the new storage-time validation.
Version affected: ≤2.5.45
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated MISP user who can set their user-configurable homepage can store a protocol-relative URL such as //attacker.example. When that homepage is used by post-login routing, the browser can be redirected to the external origin.
Are default installations affected?
The issue depends on a user-configurable homepage value being set to an unsafe path. The described exploit requires an authenticated user to supply such a value; the data does not indicate that a default homepage alone triggers the redirect.
What should be done if upgrading is not immediately possible?
Prevent or review user homepage settings that begin with // or /\, and remove values that specify an external host, scheme, or userinfo. Legacy unsafe homepage values should also be checked because they may already be stored.
How can administrators identify potentially affected stored settings?
Review stored user homepage values for protocol-relative URLs such as //attacker.example, as well as values containing a host, scheme, userinfo, control characters, malformed URL content, or unsafe leading // or /\. These are the categories rejected by the fixed validation.