{"id":"CVE-2026-58450","title":"Invoice Ninja 5.13.26 - Open Redirect in Client Portal Login via intended Parameter","summary":"Invoice Ninja through 5.13.26 contains an open redirect vulnerability in the client portal login that allows unauthenticated attackers to redirect authenticated victims to attacker-controlled external URLs by injecting a malicious value …","severity":"medium","cvss":4.3,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N","cvssSource":"cna","cwe":["CWE-601"],"vendor":"invoiceninja","product":"invoiceninja","affected":["invoiceninja <= 5.13.26"],"ssvc":{"exploitation":"poc","automatable":"no","technicalImpact":"partial","timestamp":"2026-07-01T13:48:42.421479Z"},"exploitAvailable":true,"published":"2026-06-30","updated":"2026-11-08","sourceUpdated":"2026-11-08T14:07:02.962Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-58450","references":[{"url":"https://github.com/invoiceninja/invoiceninja/issues/12039","label":"Researcher Disclosure"},{"url":"https://www.vulncheck.com/advisories/invoice-ninja-open-redirect-in-client-portal-login-via-intended-parameter"}],"tags":["cve.org","exploit-available"],"epss":0.00293,"epssPercentile":0.22066,"ingestedAt":"2026-11-08T14:51:22.293Z","slug":"CVE-2026-58450","body":"## Overview\n\nInvoice Ninja through 5.13.26 contains an open redirect vulnerability in the client portal login that allows unauthenticated attackers to redirect authenticated victims to attacker-controlled external URLs by injecting a malicious value into the intended query parameter. Attackers can craft a client login link with an external URL in the intended parameter, which is stored in the session without host validation and emitted verbatim via a bare redirect in the ContactLoginController authenticated() handler after the victim completes a legitimate login, enabling phishing attacks.\n\n## Affected\n\n- `invoiceninja <= 5.13.26`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":36,"depthScoreParts":{"impact":23.7,"likelihood":0.1,"exploitation":12,"ransomware":0},"changes":[]}