CVE-2021-41826

PlaceOS Authentication Service before 1.29.10.0 allows app/controllers/auth/sessions_controller.rb open redirect.

• CWE-601

• http://packetstormsecurity.com/files/164345/PlaceOS-1.2109.1-Open-Redirection.htmlExploit, Third Party Advisory, VDB Entry
• https://github.com/PlaceOS/auth/issues/36Exploit, Patch, Third Party Advisory
• http://packetstormsecurity.com/files/164345/PlaceOS-1.2109.1-Open-Redirection.htmlExploit, Third Party Advisory, VDB Entry
• https://github.com/PlaceOS/auth/issues/36Exploit, Patch, Third Party Advisory

Published

Sep 30, 2021

Last Modified

Jun 17, 2026

Status

Modified

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-41819CGI::Cookie.parse in Ruby through 2.6.8 mishandles security …7.5
• CVE-2021-4182Crash in the RFC 7468 dissector in Wireshark 3.6.0 and 3.4.0…7.5
• CVE-2021-41821Wazuh Manager in Wazuh through 4.1.5 is affected by a remote…6.5
• CVE-2021-41823The Web Application Firewall (WAF) in Kemp LoadMaster 7.2.54…6.1
• CVE-2021-41824Craft CMS before 3.7.14 allows CSV injection.8.8
• CVE-2021-41825Verint Workforce Optimization (WFO) 15.2.5.1033 allows HTML …5.3
• CVE-2021-41827Zoho ManageEngine Remote Access Plus before 10.1.2121.1 has …7.5
• CVE-2021-41828Zoho ManageEngine Remote Access Plus before 10.1.2121.1 has …7.5
• CVE-2021-41829Zoho ManageEngine Remote Access Plus before 10.1.2121.1 reli…7.5
• CVE-2021-4183Crash in the pcapng file parser in Wireshark 3.6.0 allows de…5.5
• CVE-2021-41830It is possible for an attacker to manipulate signed document…7.5
• CVE-2021-41831It is possible for an attacker to manipulate the timestamp o…5.3