CVE-2026-103576 in Windows
Summary
by MITRE • 10/13/2026
Url redirection to untrusted site ('open redirect') in Active Directory Federation Services (AD FS) allows an unauthorized attacker to perform spoofing over a network.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/14/2026
Active Directory Federation Services, commonly referred to as AD FS, serves as a critical identity provider within Microsoft enterprise environments, facilitating single sign-on and federated authentication across diverse security domains. The vulnerability described constitutes an open redirect flaw inherent in the service's handling of URL parameters during the federation protocol exchange process. This specific weakness allows an attacker who can interact with the AD FS endpoint to manipulate query strings or request headers such that the resulting redirection target is not validated against a trusted allowlist. Consequently, when a user authenticates through this compromised flow, they are redirected away from the intended identity provider page to a domain controlled by the adversary rather than remaining within the legitimate federation context.
The technical mechanism behind this flaw typically involves insufficient validation of redirect URIs passed during the initial authentication request or subsequent token response phases of protocols like SAML 2.0 or WS-Federation. Instead of strictly enforcing that redirection targets match pre-configured relying party trust metadata, the service accepts arbitrary external URLs. This lack of strict domain verification creates a pathway for phishing attacks where the attacker crafts a malicious link containing their own URL as the redirect target. When an unsuspecting user clicks this link and enters credentials on what appears to be a legitimate AD FS login page due to the initial trusted origin, those credentials are subsequently transmitted to the attacker's server upon redirection.
The operational impact of this vulnerability is severe, primarily enabling credential harvesting and session hijacking scenarios. By leveraging open redirects in identity providers, attackers can bypass traditional phishing detection mechanisms that rely on visual cues or domain reputation checks, as the user begins their interaction with a trusted Microsoft infrastructure component before being diverted to an untrusted site. This technique significantly increases the success rate of social engineering attacks because it exploits the inherent trust users place in enterprise login portals. Furthermore, if combined with other vulnerabilities such as cross-site scripting or token manipulation, this redirect flaw can facilitate more complex attack chains including account takeover and lateral movement within a compromised network perimeter.
Mitigation strategies for this vulnerability require both immediate patching and long-term architectural adjustments. Organizations must ensure that their AD FS servers are updated to the latest cumulative updates provided by Microsoft which address these specific validation logic errors. In addition to applying patches, administrators should implement strict Content Security Policy headers where applicable and configure web application firewalls to detect and block requests containing suspicious redirect parameters. It is also advisable to review relying party trust configurations to ensure that only explicitly defined and verified URIs are permitted for redirections. User awareness training remains crucial as well, emphasizing the importance of verifying URL domains before entering sensitive credentials even when the initial page appears legitimate.
From a classification perspective, this vulnerability aligns with CWE-601, which defines Open Redirect flaws resulting from improper validation of user-supplied input used to construct navigation targets. In terms of offensive security frameworks, it maps directly to MITRE ATT&CK technique T1566.002, known as Spearphishing Link, where attackers use links that redirect users away from the initial trusted site to a malicious destination. Understanding this mapping helps in prioritizing remediation efforts based on the potential for exploitation within specific threat landscapes and ensures that defensive controls are aligned with recognized industry standards for preventing identity-based attacks.