CVE-2026-58450Medium· 4.3▾ TwilightPoC availableInvoice Ninja through 5.13.26 contains an open redirect vulnerability in the client portal login that allows unauthenticated attackers to redirect authenticated victims to attacker-controlled external URLs by injecting a malicious value …
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 23.7 · likelihood 0.1 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
Last analysed / modified upstream
0.3%
Invoice Ninja through 5.13.26 contains an open redirect vulnerability in the client portal login that allows unauthenticated attackers to redirect authenticated victims to attacker-controlled external URLs by injecting a malicious value into the intended query parameter. Attackers can craft a client login link with an external URL in the intended parameter, which is stored in the session without host validation and emitted verbatim via a bare redirect in the ContactLoginController authenticated() handler after the victim completes a legitimate login, enabling phishing attacks.
invoiceninja <= 5.13.26Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-82029Medium· 6.5Invoice Ninja < 5.13.28 Broken Access Control via Vendor Portal
CVE-2026-122132Medium· 6.1go-chi chi 5.2.2 through 5.5.0 Open Redirect via RedirectSlashes Middleware
CVE-2026-2376Medium· 4.9Mirror-registry: quay: quay: server-side request forgery via open redirect vulnerability in web interface
CVE-2026-118658Medium· 4.7Echo has Arbitrary Scheme Injection in WWWRedirect/NonWWWRedirect Middlewares via X-Forwarded-Proto
CVE-2026-115537Medium· 4.3gedelumbung HospitalManagement URL Validation routing_pages.php simpan redirect
CVE-2026-112251Medium· 4.3antoinersx clawhost Reverse Proxy reverseProxy.ts handleRequest redirect