CVE-2026-46688

This CVE describes an open redirect vulnerability in MRBS (Meeting Room Booking System), a PHP application frequently deployed on institutional networks — university intranets, corporate infrastructure, and organizational internal portals. The vulnerability allows an attacker to craft a URL pointing to a legitimate MRBS installation that redirects victims to a spoofed login page, enabling credential harvesting while leveraging the trusted domain to bypass email security filters. Treat this as equivalent to an authentication bypass rather than a low-severity redirect. MRBS typically integrates with institutional authentication systems — LDAP directories, CAS, SSO infrastructure. When an open redirect exists inside an application that already lives within your authentication perimeter, the attack chain is direct: user clicks a link appearing to come from your internal booking system, gets redirected to a lookalike login page, and enters credentials that compromise your entire identity trust chain. This is not hypothetical; it's the exact phishing template that makes open redirects dangerous despite their seemingly minimal CVSS impact. Prioritise these actions: upgrade to MRBS 1.12.2 immediately, as this is the only version containing the fix. There are no compensating controls documented for this vulnerability — the codebase was never architected with redirect validation layers, which is why the CVE explicitly notes no workarounds exist. If immediate patching is impossible, consider network-level controls that isolate MRBS from authentication infrastructure, though this is a temporary measure at best. Be aware of the deployment reality: MRBS is volunteer-maintained open-source software that calcifies on institutional servers. Many deployments are running versions years older than 1.12.2 with no update governance. The CVE database will not notify you that your instance is vulnerable — you need to audit your own infrastructure. The EPSS score of 0.00249 is misleading for internal-network deployments; it models opportunistic internet scanning, not targeted spear-phishing from within your organizational perimeter.

Reviewed through automated stages and approved by a human before publication.