CVE-2026-111622Medium· 6.8▾ TwilightPoC availablesmart-sso through 2.1.1 contains an open redirect vulnerability in the /login handler that allows unauthenticated attackers to steal OAuth2 authorization codes by supplying an unvalidated redirectUri parameter. Attackers can send crafted…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 37.4 · likelihood 0.1 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Oct 17.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Exploit / PoC code exists
0.4%
smart-sso through 2.1.1 contains an open redirect vulnerability in the /login handler that allows unauthenticated attackers to steal OAuth2 authorization codes by supplying an unvalidated redirectUri parameter. Attackers can send crafted /login links to users with active SSO sessions, then redeem stolen codes at /oauth2/access_token with any valid client credentials to obtain victims' access tokens.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-115537Medium· 4.3gedelumbung HospitalManagement URL Validation routing_pages.php simpan redirect
CVE-2026-112251Medium· 4.3antoinersx clawhost Reverse Proxy reverseProxy.ts handleRequest redirect
CVE-2026-112040Medium· 4.3diem-project diem Sign-In BasedmUserActions.class.php redirect
CVE-2026-112034Medium· 4.3aircheng-org iWebShop-5 Login Redirect _userInfo.php redirect
CVE-2026-111385Medium· 4.8Nezha 2.1.0 before 2.3.15 Host Header Injection via MCP Transfer Tools
CVE-2026-55840Medium· 5.4Scoold is a Q&A and a knowledge sharing platform for teams