CVE-2026-66414

MediumCVSS 6.1/10Last modified Jul 31, 2026

Description

Leantime 3.6.2 contains an open redirect vulnerability in the Login controller that allows unauthenticated attackers to redirect authenticated users to arbitrary external sites by manipulating the redirectUrl POST parameter. Attackers can craft a malicious login URL with a tampered redirectUrl value that bypasses FILTER_SANITIZE_URL validation to redirect victims to attacker-controlled sites for phishing or credential theft.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-601

Affected software

No affected versions have been published.

Timeline

Published: Jul 30, 2026
Last modified: Jul 31, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-664158.5Leantime 3.6.2 contains a server-side request forgery and local file inclusion vulnerability that allows authenticated attackers to read int CVE-2026-664168.8Leantime 3.6.2 contains a cross-site request forgery vulnerability that allows unauthenticated attackers to perform state-changing actions o CVE-2026-664189.3OpenClaw Dashboard v3.0.0 contains a stored cross-site scripting vulnerability that allows unauthenticated remote attackers to inject arbitr CVE-2026-66426.4The Media Library Assistant plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the bulk edit preset export/import mechani CVE-2026-664208.8MeshCentral 1.1.21 contains a cross-site WebSocket hijacking protection bypass vulnerability that allows unauthenticated remote attackers to CVE-2026-664219.3OpenClaw Dashboard contains a stored cross-site scripting vulnerability that allows unauthenticated remote attackers to execute arbitrary Ja CVE-2026-664228.1Improper Authorization vulnerability in Apache Tomcat cause by security-role-ref definitions being incorrectly used as role aliases within t CVE-2026-664249.8Unauthenticated Privilege Escalation in SMS Alert Order Notifications <= 3.9.7 versions.CVE-2026-664256.5Unauthenticated Broken Authentication in Gutena Forms – Contact Form, Survey Form, Feedback Form, Booking Form, and Custom Form Builder <= 1 CVE-2026-664267.1Unauthenticated Cross Site Scripting (XSS) in WP-Stats <= 2.56 versions.CVE-2026-664277.6Administrator SQL Injection in WP Google Review Slider <= 18.4 versions.CVE-2026-664284.3Unauthenticated Cross Site Request Forgery (CSRF) in WP Google Review Slider <= 18.4 versions.