CVE-2026-93869: Cotonti through 1.0.0 Open Redirect via Unanchored cot_url_check() Regex
Cotonti through 1.0.0 contains an open redirect vulnerability in the coturlcheck() function that validates redirect destinations using a regular expression lacking an end-of-string anchor. Attackers can bypass the redirect guard by supplying hostnames beginning with the site domain to redirect users to attacker-controlled hosts through the ratings plugin or other redirect callers.
Affected Software
Event History
Frequently Asked Questions
Which deployments should be treated as affected?
Cotonti versions through 1.0.0 should be treated as affected. The issue is in the shared cot_url_check() function, so exposure can extend beyond a single feature where redirect destinations are validated through that function.
What does an attacker need to exploit this issue?
The attacker can exploit it remotely without authentication by supplying a crafted redirect destination whose hostname begins with the site domain. Successful exploitation requires a user to follow or interact with the resulting redirect.
Which application paths may expose the redirect behavior?
The ratings plugin is identified as one affected redirect caller. Other application paths that use cot_url_check() to validate redirect destinations may also be exposed.