{"id":"CVE-2026-81509","title":"nforwardauth: Unvalidated r parameter allows post-authentication open redirect","summary":"nforwardauth is a forward auth service that allows the use of a single authentication middleware for multiple sites. Versions prior to 1.5.1 accept an unvalidated `r` query parameter on the `/login` endpoint and use them as the post-auth…","severity":"medium","cvss":6.1,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","cvssSource":"cna","cwe":["CWE-601"],"vendor":"nosduco","product":"nforwardauth","affected":["nforwardauth < 1.5.1"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-10-26T19:29:40.719883Z"},"published":"2026-10-26","updated":"2026-10-26","sourceUpdated":"2026-10-26T19:34:58.155Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-81509","references":[{"url":"https://github.com/nosduco/nforwardauth/security/advisories/GHSA-q64r-v7j5-6hfg","label":"https://github.com/nosduco/nforwardauth/security/advisories/GHSA-q64r-v7j5-6hfg"},{"url":"https://github.com/nosduco/nforwardauth/pull/71","label":"https://github.com/nosduco/nforwardauth/pull/71"},{"url":"https://github.com/nosduco/nforwardauth/commit/664f2602f9e1459558d1c4c55019f6d48bc64c43","label":"https://github.com/nosduco/nforwardauth/commit/664f2602f9e1459558d1c4c55019f6d48bc64c43"},{"url":"https://github.com/nosduco/nforwardauth/releases/tag/v1.5.1","label":"https://github.com/nosduco/nforwardauth/releases/tag/v1.5.1"}],"tags":["cve.org"],"ingestedAt":"2026-10-26T17:33:33.054Z","epss":0.00318,"epssPercentile":0.24537,"slug":"CVE-2026-81509","body":"## Overview\n\nnforwardauth is a forward auth service that allows the use of a single authentication middleware for multiple sites. Versions prior to 1.5.1 accept an unvalidated `r` query parameter on the `/login` endpoint and use them as the post-authentication redirect destination. An unauthenticated attacker can create a legitimate `nforwardauth` login URL that redirects a victim to an attacker-controlled website after the victim successfully authenticates. This issue may facilitate phishing and other social-engineering attacks by abusing the trust associated with the legitimate authentication domain. This vulnerability does not provide an unauthenticated ForwardAuth bypass. Version 1.5.1 contains a patch.\n\n## Affected\n\n- `nforwardauth < 1.5.1`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":34,"depthScoreParts":{"impact":33.6,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}