---
id: CVE-2026-81509
title: 'nforwardauth: Unvalidated r parameter allows post-authentication open redirect'
summary: >-
  nforwardauth is a forward auth service that allows the use of a single
  authentication middleware for multiple sites. Versions prior to 1.5.1 accept
  an unvalidated `r` query parameter on the `/login` endpoint and use them as
  the post-auth…
severity: medium
cvss: 6.1
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N'
cvssSource: cna
cwe:
  - CWE-601
vendor: nosduco
product: nforwardauth
affected:
  - nforwardauth < 1.5.1
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-10-26T19:29:40.719883Z'
published: '2026-10-26'
updated: '2026-10-26'
sourceUpdated: '2026-10-26T19:34:58.155Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-81509'
references:
  - url: >-
      https://github.com/nosduco/nforwardauth/security/advisories/GHSA-q64r-v7j5-6hfg
    label: >-
      https://github.com/nosduco/nforwardauth/security/advisories/GHSA-q64r-v7j5-6hfg
  - url: 'https://github.com/nosduco/nforwardauth/pull/71'
    label: 'https://github.com/nosduco/nforwardauth/pull/71'
  - url: >-
      https://github.com/nosduco/nforwardauth/commit/664f2602f9e1459558d1c4c55019f6d48bc64c43
    label: >-
      https://github.com/nosduco/nforwardauth/commit/664f2602f9e1459558d1c4c55019f6d48bc64c43
  - url: 'https://github.com/nosduco/nforwardauth/releases/tag/v1.5.1'
    label: 'https://github.com/nosduco/nforwardauth/releases/tag/v1.5.1'
tags:
  - cve.org
ingestedAt: '2026-10-26T17:33:33.054Z'
epss: 0.00318
epssPercentile: 0.24537
---

## Overview

nforwardauth is a forward auth service that allows the use of a single authentication middleware for multiple sites. Versions prior to 1.5.1 accept an unvalidated `r` query parameter on the `/login` endpoint and use them as the post-authentication redirect destination. An unauthenticated attacker can create a legitimate `nforwardauth` login URL that redirects a victim to an attacker-controlled website after the victim successfully authenticates. This issue may facilitate phishing and other social-engineering attacks by abusing the trust associated with the legitimate authentication domain. This vulnerability does not provide an unauthenticated ForwardAuth bypass. Version 1.5.1 contains a patch.

## Affected

- `nforwardauth < 1.5.1`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.