CVE-2026-93871: Cotonti through 1.0.0 Stored Open Redirect via Page redir: Prefix
Cotonti through 1.0.0 fails to validate redirect destinations in page bodies prefixed with redir:, allowing authenticated users with page creation or edit permissions to store redirects to arbitrary external hosts. Attackers can craft pages on trusted domains that redirect visitors to malicious sites for phishing attacks without administrative privileges.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Update Cotonti to validate redirect destinations for page bodies using the redir: prefix so redirect targets cannot be stored to arbitrary external hosts.
Cotonti (Stored Open Redirect via Page redir: Prefix) redirect destination validation for page bodies prefixed with redir: = validated (reject arbitrary external hosts)
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated user who has permission to create or edit pages can exploit it. Administrative privileges are not required.
What must an attacker do to use the vulnerability?
The attacker must create or modify a page body to use the redir: prefix with an arbitrary external destination. A visitor must then follow the trusted-site page and be redirected.
Are unauthenticated visitors at risk?
Visitors do not need to be authenticated to be affected by a malicious stored redirect, but exploitation requires an authenticated user with page creation or editing permissions to plant it.
How can I check for existing malicious redirects?
Review page bodies created or edited by users with page permissions for use of the redir: prefix, particularly where it points to external hosts. Pages using that prefix can redirect visitors away from the trusted site.