Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
6.1

Roxy-WI login redirect can send users to attacker site

CVE-2026-45566 · published 4 months ago
Summary

The Roxy-WI web console (versions up to 8.2.6.4) lets attackers craft a login link that appears to go to the legitimate site but actually sends users to a malicious website. This happens because the system does not properly block specially formatted URLs that include a user name before the host name. Until a fix is released, avoid clicking login links from unknown sources and consider updating or applying a custom filter to block such URLs.

Original advisory text
Roxy-WI: Open redirect on /login?next= via basic-auth userinfo syntax bypass
Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. In versions 8.2.6.4 and prior, the login flow allow-lists next URLs by rejecting strings containing https:// or http:// substrings, then constructs https://{request.host}{next_url} and the JS client redirects via window.location.replace(). The block does not consider the userinfo@host syntax. [email protected]/path produces https://[email protected]/path, which all modern browsers route to evil.example. At time of publication, there are no publicly available patches.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker partial control
Severity
6.1 Medium
Exploitation
<1% chance of attack within 30 days
Type
CWE-601Open Redirect
Timeline
Published10 Jun 2026
Updated26 Oct 2026
First seen10 Jun 2026
Sources
CVE-2026-45566 · NVD
CVE-2026-45566 · OSV
GHSA-xw9x-68gg-mp5h · GHSA
Track software like this
Free during beta