CVE-2026-92216: a2ui-project a2ui Binder generic-binder.ts openUrl redirect
A vulnerability was found in a2ui-project a2ui up to 0.10.7. Affected by this issue is the function openUrl of the file renderers/webcore/src/v09/rendering/generic-binder.ts of the component Binder. The manipulation results in open redirect. It is possible to launch the attack remotely. The project was informed of the problem early through an issue report but has not responded yet.
Affected Software
Event History
Frequently Asked Questions
Which deployments are affected?
a2ui-project a2ui versions up to and including 0.10.7 are affected where the Binder component's web-core v0_9 generic-binder openUrl functionality is in use.
Does exploitation require access to an account or user action?
The issue can be exploited remotely and requires no privileges or authentication. It does require user interaction.
What is the expected impact of a successful exploit?
Successful manipulation of openUrl causes an open redirect. The reported impact is limited to integrity; no confidentiality or availability impact is reported.