CVE-2026-101151

MediumCVSS 4.3/10Last modified Oct 7, 2026

Description

Insufficient validation of request in login flow could allow a remote, unauthenticated attacker to craft a URL that, when clicked by a user, redirects the user's browser to an arbitrary external site upon completion of the authentication process.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-601

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

Vendor	Product	Versions
Arista Networks	CloudVision Portal	2026.2.0; >= 2026.1.0, <= 2026.1.2; >= 2025.3.0, <= 2025.3.3; >= 2020.3.0, < 2025.3.0

References

https://www.arista.com/en/support/advisories-notices/security-advisory/24803-security-advisory-0187

Timeline

Published: Oct 6, 2026
Last modified: Oct 7, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-1011528.0Insufficient validation in the Single Sign-On (SSO) login flow could allow a remote, unauthenticated attacker to craft a URL that, when clic CVE-2026-1011538.0On affected versions of CloudVision Portal (on-premises) or CloudVision Sensor, a path traversal vulnerability exists. An authenticated user CVE-2026-1011547.2An authenticated remote attacker with specific permissions can read or write files on the platform filesystem beyond the intended scope thro CVE-2026-1011559.1An authenticated remote attacker with specific permissions can read or write files on the platform filesystem beyond the intended scope thro CVE-2026-1011568.4A stored cross-site scripting (XSS) vulnerability may allow an authenticated, high-privilege administrator to store malicious content in a c CVE-2026-1011578.7A stored cross-site scripting (XSS) vulnerability may allow an unauthenticated attacker with adjacent-network access to inject malicious con CVE-2026-1011588.4A missing input validation vulnerability in the Fileserver upload API allows an authenticated attacker with file upload privileges to execut CVE-2026-1011597.5The WP Ultimate Review WordPress plugin before 2.4.4 does not properly sanitise and escape reviews submitted through its public review form,CVE-2026-101164.3A security flaw has been discovered in Open5GS up to 2.7.7. This vulnerability affects the function ogs_sbi_xact_add in the library /lib/cor CVE-2026-1011607.5The WP Ultimate Review WordPress plugin before 2.4.4 does not validate that a submitted review rating is numeric before storing it and later CVE-2026-1011617.5The WP Ultimate Review WordPress plugin before 2.4.4 does not prevent unauthenticated users from storing crafted review content that makes t CVE-2026-1011626.4The WP Ultimate Review WordPress plugin before 2.4.4 does not escape some of its review overview settings before outputting them in posts, w