CVE-2025-30164: Icinga Web 2 has open redirect on login page

Severity: medium (CVSS 6.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-03-26 · updated 2026-06-17
Weakness: CWE-601

Description

Icinga Web 2 is an open source monitoring web interface, framework and command-line interface. A vulnerability in versions prior to 2.11.5 and 2.12.13 vulnerability allows an attacker to craft a URL that, once visited by an authenticated user (or one that is able to authenticate), allows to manipulate the backend to redirect the user to any location. This issue has been resolved in versions 2.11.5 and 2.12.3 of Icinga Web 2. No known workarounds are available.

Affected products

icingaweb2: before 2.11.5; from 2.12.0 before 2.12.3 — fixed in 2.11.5, 2.12.3

How to fix

Upgrade to a fixed version: icingaweb2 2.11.5, 2.12.3. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2025-30164 or the next vulnerability affects your stack