CVE-2026-111622
HIGH
7,6
Source: [email protected]
Attack Vector: network
Attack Complexity: high
Privileges Required: none
User Interaction: passive
Confidentiality: N/A
Integrity: N/A
Availability: N/A
MEDIUM
6,8
Source: [email protected]
Attack Vector: network
Attack Complexity: high
Privileges Required: none
User Interaction: required
Scope: unchanged
Confidentiality: high
Integrity: high
Availability: none
Description
AI Translation Available
smart-sso through 2.1.1 contains an open redirect vulnerability in the /login handler that allows unauthenticated attackers to steal OAuth2 authorization codes by supplying an unvalidated redirectUri parameter. Attackers can send crafted /login links to users with active SSO sessions, then redeem stolen codes at /oauth2/access_token with any valid client credentials to obtain victims' access tokens.
EPSS (Exploit Prediction Scoring System)
Trend Analysis
EPSS (Exploit Prediction Scoring System)
Prevede la probabilità di sfruttamento basata su intelligence sulle minacce e sulle caratteristiche della vulnerabilità.
EPSS Score
0,0043
Percentile
0,4th
Updated
EPSS Score Trend (Last 3 Days)
601
URL Redirection to Untrusted Site ('Open Redirect')
DraftCommon Consequences
Security Scopes Affected:
Access Control
Confidentiality
Other
Potential Impacts:
Bypass Protection Mechanism
Gain Privileges Or Assume Identity
Other
Applicable Platforms
Technologies:
Web Based, Web Server
https://hackmd.io/@hieuPenguinnn/smart-sso-oauth2-code-leak-open-redirect
https://github.com/a466350665/smart-sso
https://github.com/a466350665/smart-sso/blob/1.6.0/smart-sso-server/src/main/ja…
https://github.com/a466350665/smart-sso/blob/1.6.0/smart-sso-server/src/main/ja…
https://github.com/a466350665/smart-sso/blob/2.1.1/smart-sso-server/src/main/ja…
https://hackmd.io/@hieuPenguinnn/smart-sso-oauth2-code-leak-open-redirect
https://www.vulncheck.com/advisories/smart-sso-through-2.1.1-oauth2-authorizati…