CVE-2026-40080

Cacti is an open source performance and fault management framework. Versions 1.2.30 and prior are vulnerable to Open Redirect through a substring check rather than a host check at str_contains($referer, CACTI_PATH_URL). When the user's login_opts == '1' (redirect to referer after login), the function used $_SERVER['HTTP_REFERER'] directly. An attacker could craft a referer such as https://evil.com/cacti/. Where CACTI_PATH_URL is /cacti/, the substring matches and the user is redirected to evil.com after login. The pre-existing validate_redirect_url() helper at lib/html_utility.php performed proper validation but was not invoked from auth_login_redirect(). This issue has been fixed in version 1.2.31.

• CWE-601

• https://github.com/Cacti/cacti/releases/tag/release%2F1.2.31Product, Release Notes
• https://github.com/Cacti/cacti/security/advisories/GHSA-6gr7-53g8-vchqExploit, Mitigation, Vendor Advisory
• https://github.com/Cacti/cacti/security/advisories/GHSA-6gr7-53g8-vchqExploit, Mitigation, Vendor Advisory

Published

Jun 25, 2026

Last Modified

Jun 29, 2026

Status

Analyzed

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-40074SvelteKit is a framework for rapidly developing robust, perf…7.5
• CVE-2026-40075OpenMRS Core is an open source electronic medical record sys…7.5
• CVE-2026-40076OpenMRS Core is an open source electronic medical record sys…8.8
• CVE-2026-40077Beszel is a server monitoring platform. Prior to 0.18.7, som…3.1
• CVE-2026-40079Cacti is an open source performance and fault management fra…9.8
• CVE-2026-4008A flaw has been found in Tenda W3 1.0.0.3(2204). This issue …8.8
• CVE-2026-40082Cacti is an open source performance and fault management fra…5.4
• CVE-2026-40083Cacti is an open source performance and fault management fra…7.2
• CVE-2026-40084Cacti is an open source performance and fault management fra…6.5
• CVE-2026-40086Rembg is a tool to remove images background. Prior to 2.0.75…5.3
• CVE-2026-40087LangChain is a framework for building agents and LLM-powered…5.3
• CVE-2026-40088PraisonAI is a multi-agent teams system. Prior to 4.5.121, t…9.6