Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
5.1

Saltcorn: Cross-Origin Redirect Attack Through Login

CVE-2026-42259 · published 6 months ago
Summary

A vulnerability in Saltcorn's login system allows an attacker to trick a user into visiting a malicious website after logging in. This can happen if a user is tricked into logging in through a specially crafted Saltcorn URL. To protect against this, ensure that users only log in through trusted URLs and keep your Saltcorn installation up to date with the latest security patches.

What to do
  • Update saltcorn @saltcorn/server to version 1.4.6.
  • Update saltcorn @saltcorn/server to version 1.5.6.
  • Update saltcorn @saltcorn/server to version 1.6.0-beta.5.
Affected software
Ecosystem VendorProductAffected versions
npm saltcorn @saltcorn/server < 1.4.6
>= 1.5.0-beta.0, < 1.5.6
>= 1.6.0-alpha.0, < 1.6.0-beta.5
Fix: upgrade to 1.4.6
Original advisory text
Saltcorn is an extensible, open source, no-code database application builder. Prior to versions 1.4.6, 1.5.6, and 1.6.0-beta.5, Saltcorn validates the post-login dest parameter with a string check ...
Saltcorn is an extensible, open source, no-code database application builder. Prior to versions 1.4.6, 1.5.6, and 1.6.0-beta.5, Saltcorn validates the post-login dest parameter with a string check that only blocks :/ and //. Because all WHATWG-compliant browsers normalise backslashes (\) to forward slashes (/) for special schemes, a payload such as /\evil.com/path slips through is_relative_url(), is emitted unchanged in the HTTP Location header, and causes the browser to navigate cross-origin to an attacker-controlled domain. The bug is reachable on a default install and only requires a victim who can be tricked into logging in via a crafted Saltcorn URL. This issue has been patched in versions 1.4.6, 1.5.6, and 1.6.0-beta.5.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker partial control
Severity
5.1 Medium
Exploitation
<1% chance of attack within 30 days
Type
CWE-601Open Redirect
Timeline
Published7 May 2026
Updated4 Nov 2026
First seen6 May 2026
Sources
GHSA-f3g8-9xv5-77gv · OSV
CVE-2026-42259 · NVD
Track software like this
Free during beta