Skip to content
Heist/ feed
Back to feed
Medium

Leantime Open Redirect in Login Controller via redirectUrl Parameter

Type: advisorySources: OSV

Leantime 3.6.2 contains an open redirect vulnerability in the Login controller that allows unauthenticated attackers to redirect authenticated users to arbitrary external sites by manipulating the redirectUrl POST parameter. Attackers can craft a malicious login URL with a tampered redirectUrl value that bypasses FILTER_SANITIZE_URL validation to redirect victims to attacker-controlled sites for phishing or credential theft.

Products
Not specified
Affected versions
Not specified
Fixed versions
Not specified
CVEs
CVE-2026-66414
Confirmed fixed CVEs
Not specified
Updated in this feed
6 Nov 2026, 02:22 UTC · Revision 1

Source evidence

Leantime Open Redirect in Login Controller via redirectUrl Parameter

core-osv · Original source

Published 30 Jul 2026, 16:36 UTC

Leantime 3.6.2 contains an open redirect vulnerability in the Login controller that allows unauthenticated attackers to redirect authenticated users to arbitrary external sites by manipulating the redirectUrl POST parameter. Attackers can craft a malicious login URL with a tampered redirectUrl value that bypasses FILTER_SANITIZE_URL validation to redirect victims to attacker-controlled sites for phishing or credential theft.

osv:CVE-2026-66414
Complete source record
{
  "id": "e64272c6bc72906e7148039d20bebbb95813f821f8a30af262e96c59413124fd",
  "url": "https://osv.dev/vulnerability/CVE-2026-66414",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "Leantime Open Redirect in Login Controller via redirectUrl Parameter",
    "summary": "Leantime 3.6.2 contains an open redirect vulnerability in the Login controller that allows unauthenticated attackers to redirect authenticated users to arbitrary external sites by manipulating the redirectUrl POST parameter. Attackers can craft a malicious login URL with a tampered redirectUrl value that bypasses FILTER_SANITIZE_URL validation to redirect victims to attacker-controlled sites for phishing or credential theft.",
    "evidence": "osv:CVE-2026-66414",
    "products": [],
    "severity": "medium",
    "structured": {
      "id": "CVE-2026-66414",
      "aliases": [
        "CVE-2026-66414",
        "GHSA-wprg-q8m6-jhp9"
      ],
      "metrics": [
        {
          "type": "CVSS_V4",
          "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N"
        }
      ],
      "affected": [
        {
          "ranges": [
            {
              "repo": "https://github.com/leantime/leantime",
              "type": "GIT",
              "events": [
                {
                  "introduced": "0"
                },
                {
                  "last_affected": "d6c4672e23380c70d02649c60576a71f60f69b5c"
                }
              ],
              "database_specific": {
                "extracted_events": [
                  {
                    "range": [
                      {
                        "introduced": "0"
                      },
                      {
                        "last_affected": "3.6.2"
                      }
                    ],
                    "source": "AFFECTED_FIELD",
                    "strategy": "StandardRange"
                  }
                ]
              }
            }
          ],
          "versions": [
            "v3.6.2",
            "latest",
            "v3.6.1",
            "v3.6.0",
            "v3.5.12",
            "v3.5.11",
            "v3.5.10",
            "v3.5.8",
            "v3.5.7",
            "v3.5.6",
            "v3.5.5",
            "v3.5.4",
            "v3.5.3",
            "v3.5.2",
            "v3.5.1",
            "v3.4.12",
            "v3.4.11",
            "v3.4.10",
            "v3.4.9",
            "v3.4.7",
            "v3.4.6",
            "v3.4.5",
            "v3.4.4",
            "v3.4.3",
            "v3.4.2",
            "v3.4.1",
            "v3.4.0",
            "v3.3.3",
            "v3.3.1",
            "v3.3.0",
            "v3.2.1",
            "v3.2.0",
            "v3.2.0-beta-2",
            "v3.2.0-beta",
            "v3.1.4",
            "v3.1.3",
            "v3.1.2",
            "v3.1.1",
            "v3.1.0-beta",
            "v3.0.7",
            "v3.0.6",
            "v3.0.5",
            "v3.0.4",
            "v3.0.3",
            "v3.0.1",
            "v3.0.2",
            "v3.0.0",
            "v3.0.0-beta",
            "v2.4.8",
            "v2.4.7",
            "v2.4.5",
            "v2.4.4",
            "v2.4.3",
            "v2.4.2",
            "v2.4.1",
            "v2.4-beta-8",
            "v2.4",
            "v2.4-beta-7",
            "v2.4-beta",
            "v2.3.27",
            "v2.3.26",
            "v2.3.24",
            "v2.3.25",
            "v2.3.23",
            "v2.3.22",
            "v2.3.21",
            "v2.3.20",
            "v2.3.19",
            "v2.3.18",
            "v2.3.17",
            "v2.3.16",
            "v2.3.15",
            "v2.3.14",
            "v2.3.13",
            "v2.3.12",
            "v2.3.11",
            "v2.3.10",
            "v2.3.9",
            "v2.3.8",
            "v2.3.7",
            "v2.3.6",
            "v2.3.5",
            "v2.3.4",
            "v2.3.3",
            "v2.3.2",
            "v2.3.1-beta",
            "v2.3.0-beta",
            "v2.3-beta",
            "v2.2.11",
            "v2.2.10",
            "v2.2.9",
            "v2.2.8",
            "v2.2.7",
            "v2.2.6",
            "v2.2.5",
            "v2.2.4",
            "v2.2.3",
            "v2.2.0",
            "v2.2.2",
            "v2.2.1",
            "v2.1.9",
            "v2.1.8",
            "v2.1.7",
            "v2.1.6",
            "v2.1.5",
            "v2.1.4",
            "v2.1.3",
            "v2.1.2",
            "v2.1.1",
            "v2.1",
            "v2.1-beta6",
            "v2.1-beta5",
            "v2.1-beta4b",
            "v2.1-beta3",
            "v2.0.14",
            "v2.1-beta2",
            "v2.1-beta",
            "v2.0.13",
            "v2.0.12",
            "v2.0.11",
            "v2.0.10",
            "v2.0.9",
            "v2.0.8",
            "v2.0.7",
            "v2.0.6",
            "v2.0.5",
            "v2.0.4",
            "v2.0.3",
            "v2.0.2",
            "v2.0.1",
            "v2.0",
            "v0.9.5-alpha"
          ],
          "database_specific": {
            "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-66414.json"
          }
        }
      ],
      "modified": "2026-10-28T02:30:46.302399567Z",
      "provider": "osv",
      "references": [
        "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/66xxx/CVE-2026-66414.json",
        "https://github.com/javokhir-sec/CVE-PoC-Hub/security/advisories/GHSA-wprg-q8m6-jhp9",
        "https://nvd.nist.gov/vuln/detail/CVE-2026-66414",
        "https://www.vulncheck.com/advisories/leantime-open-redirect-in-login-controller-via-redirecturl-parameter",
        "https://github.com/Leantime/leantime/pull/3658",
        "https://github.com/Leantime/leantime"
      ],
      "provider_metadata": {
        "cwe_ids": [
          "CWE-601"
        ],
        "cna_assigner": "VulnCheck",
        "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/66xxx/CVE-2026-66414.json"
      }
    },
    "related_cves": [
      {
        "value": "CVE-2026-66414",
        "evidence": "/id"
      }
    ],
    "security_relevant": true,
    "severity_evidence": "/severity/0/score"
  },
  "source_id": "core-osv",
  "document_id": 514239,
  "published_at": "2026-07-30T16:36:21.177+00:00"
}