CVE-2026-128637

The MISP Modules website component contains an open redirect vulnerability in its login endpoint. The /login route accepted a user-supplied next query parameter and passed it directly to Flask's redirect() function without validating the destination. An attacker could craft a URL such as https://victim-host/login?next=https://attacker.example/phish and deliver it to a user (e.g., via email or a lookalike page). After the user successfully authenticated, the application issued a 302 redirect to the attacker-controlled external URL. This enables phishing attacks where a user, believing they are still on the legitimate MISP Modules site, may enter additional credentials or sensitive information on the attacker's page. It can also be used to obscure the true destination of a link, bypassing user trust in the legitimate domain. The vulnerability requires the victim to interact with the crafted URL and complete a login, but no prior authentication or special configuration is needed on the attacker's side. The affected component is the website sub-project of misp-modules, specifically the account blueprint in website/app/account/account.py. No version boundaries are specified in the patch metadata.

• CWE-601

• https://github.com/MISP/misp-modules/commit/d115f00414e761b0b70c8c8671edac681de74a4c

Published

Nov 13, 2026

Last Modified

Nov 13, 2026

Status

Deferred

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-12858Improper Privilege Management vulnerability in ESET AV Remov…8.5
• CVE-2026-12859Missing Authorization vulnerability in Caz Informatics Servi…6.5
• CVE-2026-1286CWE-502: Deserialization of untrusted data vulnerability exi…6.5
• CVE-2026-12860In Bouncy Castle for Java before 1.85, RSA PKCS#1 verificati…5.3
• CVE-2026-12862Untrusted user data was passed verbatim to Excel exports for…5.1
• CVE-2026-12863An unvalidated redirect was contained in Venueless' social l…5.1
• CVE-2026-12865The Photo Gallery by 10Web WordPress plugin before 1.8.44 d…7.1
• CVE-2026-12866All versions of the package expr-eval are vulnerable to Code…9.8
• CVE-2026-12869The Header Footer Builder for Elementor WordPress plugin bef…6.1
• CVE-2026-1287An issue was discovered in 6.0 before 6.0.2, 5.2 before 5.2.…5.4
• CVE-2026-12872The Webinfos WordPress plugin through 1.2 does not validate …9.8
• CVE-2026-12877The Project Management, Bug and Issue Tracking Plugin WordP…9.1