CVE-2026-14171

The CVSS 6.1 score for this post-login open redirect obscures a more serious risk than generic open redirect vulnerabilities typically pose. When the redirect handler lives behind authentication, you're not targeting anonymous visitors — you're targeting users who have already proven their identity, completed MFA, and hold active session tokens. That changes the threat model entirely. The attack chain is straightforward: an attacker crafts a URL to your legitimate instance containing a controlled destination parameter, passes it through the post-login redirect handler, and the authenticated user lands on an attacker-controlled domain. From there, the attacker can harvest credentials entered on a fake interface, or more critically, capture session tokens via referrer headers. The user's browser will send the referrer (including potentially the session cookie or token in URL parameters) to the attacker's domain, enabling session hijacking without needing to crack any credentials. Two questions determine your actual exposure. First, does your session architecture expose tokens via referrer headers when users are redirected to external domains? Check whether your redirect handler carries session state in query parameters rather than using server-side session storage with proper cookie flags. Second, is there token binding or referrer policy enforcement that would limit exploitation? If your session tokens are bound to IP or user-agent and referrer policies are strict, the window narrows — but many architectures don't enforce this. For remediation, treat this as a session integrity issue rather than a simple input validation fix. Validate redirect destinations against an allowlist of internal paths rather than blocking known-bad external domains. Implement strict referrer-policy headers (no-referrer-when-downgrade or stricter) to block referrer leakage during cross-domain redirects. If your session tokens appear in URLs at any point, migrate them to HTTP-only cookies with SameSite attributes. The CVSS score may land this in your monitoring queue — escalate it based on the authenticated attack surface it exposes.

Reviewed through automated stages and approved by a human before publication.