CVE-2026-100523
Cotonti through 1.0.0 Open Redirect via message.php redirect parameter
- State
- Published
- Severity
- 5.1 Medium
- Published
- Sep 26, 2026
- Updated
- Oct 5, 2026
- Reserved
- Sep 26, 2026
Description
Cotonti through 1.0.0 contains an open redirect vulnerability in message.php that base64-decodes the redirect parameter without domain validation. Unauthenticated attackers can craft malicious links with encoded external URLs to redirect users to arbitrary sites via meta refresh tags for phishing attacks.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 5.1 Medium | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N | VulnCheck |
| 3.1 | 6.1 Medium | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N | VulnCheck |
Weaknesses
- CWE-601 URL Redirection to Untrusted Site ('Open Redirect')
Affected Products
| Product | Versions |
|---|---|
CotontiCotonti |
|
References
- https://github.com/Cotonti/Cotonti/issues/1907issue-tracking
- https://github.com/Cotonti/Cotonti/pull/1908issue-trackingpatch
- https://github.com/Cotonti/Cotonti/blob/1.0.0/message.phptechnical-description
- https://github.com/Cotonti/Cotonti/blob/1.0.0/system/common.phptechnical-description
- https://github.com/Cotonti/Cotontiproduct
- VulnCheck Advisory: Cotonti through 1.0.0 Open Redirect via message.php redirect parameterthird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.