CVE-2025-58044: JumpServer has an Open Redirect Vulnerability

Severity: medium (CVSS 6.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2025-12-01 · updated 2026-10-19
Weakness: CWE-601

Description

JumpServer is an open source bastion host and an operation and maintenance security audit system. Prior to v3.10.19 and v4.10.5, The /core/i18n// endpoint uses the Referer header as the redirection target without proper validation, which could lead to an Open Redirect vulnerability. This vulnerability is fixed in v3.10.19 and v4.10.5.

Affected products

jumpserver: before 3.10.19; from 4.0.0 before 4.10.5 — fixed in 3.10.19, 4.10.5

How to fix

Upgrade to a fixed version: jumpserver 3.10.19, 4.10.5. Check the vendor advisory for mitigations.

References

https://github.com/jumpserver/jumpserver/commit/36ae076cb021f16d2053a63651bc16d15a3ed53b
https://github.com/jumpserver/jumpserver/security/advisories/GHSA-h762-mj7p-jwjq

Get alerted when CVE-2025-58044 or the next vulnerability affects your stack