What’s Vulnerable › Vulnerabilities

CVE-2026-73671: Saurus CMS Unauthenticated Open Redirect via logout url parameter

• Severity: medium (CVSS 6.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-08-13 · updated 2026-08-31
• Weakness: CWE-601

Description

Saurus CMS Community Edition contains an unauthenticated open redirect vulnerability in the logout handling code in classes/port.inc.php, where the url parameter supplied via GET or POST is passed directly to the Location header without domain allowlist, scheme validation, or relative path enforcement. Attackers can craft a malicious logout URL containing an arbitrary external domain or javascript: URI scheme to redirect authenticated users to attacker-controlled phishing pages after session destruction, enabling credential theft and OAuth redirect abuse.

Affected products

• Saurus CMS Community Edition: through d886e5b

References

• https://github.com/DevVaibhav07/VULN-POC/blob/main/Saurus_OpenRedirect.md
• https://github.com/sauruscms/Saurus-CMS-Community-Edition
• https://www.vulncheck.com/advisories/saurus-cms-unauthenticated-open-redirect-via-logout-url-parameter
• https://github.com/DevVaibhav07/VULN-POC/blob/main/Saurus_OpenRedirect.md

Get alerted when CVE-2026-73671 or the next vulnerability affects your stack