CVE-2026-18721 in kodbox
Summary
by MITRE • 08/04/2026
A vulnerability has been found in kalcaddle kodbox 1.67 Build 02. This issue affects some unknown processing of the file /user/sso/apiLogin of the component SSO API Login. The manipulation of the argument callbackUrl leads to open redirect. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 08/04/2026
This vulnerability resides within the kalcaddle kodbox 1.67 Build 02 web application platform, specifically targeting the Single Sign-On API login component located at /user/sso/apiLogin. The flaw manifests as an open redirect vulnerability that occurs when processing the callbackUrl argument, representing a critical security weakness that permits malicious actors to manipulate the redirection flow during authentication processes. The vulnerability's classification aligns with CWE-601 Open Redirect, which is categorized under the broader category of injection flaws in web applications where unvalidated user input is used to construct redirect URLs.
The technical implementation of this vulnerability stems from inadequate validation of the callbackUrl parameter within the SSO API login functionality. When an attacker provides a malicious callbackUrl value, the application fails to properly sanitize or validate this input before using it to redirect users. This processing error creates a pathway for attackers to redirect users to arbitrary external domains, potentially facilitating phishing attacks or social engineering campaigns where victims might be tricked into visiting malicious sites under the guise of legitimate authentication processes.
The operational impact of this vulnerability is substantial as it enables remote exploitation without requiring any authentication credentials or privileged access. Attackers can craft malicious links that appear legitimate within the context of the kodbox application, potentially leading to credential theft, session hijacking, or other malicious activities. The vulnerability's public disclosure status and the vendor's lack of response creates an immediate risk environment where organizations using this version of kodbox are exposed to potential exploitation without any official patches or advisories.
Security practitioners should note that this vulnerability directly relates to ATT&CK technique T1566.002 Phishing: Spearphishing Link, which demonstrates how open redirect vulnerabilities can be weaponized to create convincing phishing attacks. Organizations utilizing kodbox 1.67 Build 02 must implement immediate mitigations including input validation for all user-supplied parameters in the SSO API login component, implementing strict URL validation that only permits redirection to known and trusted domains, and considering the implementation of a whitelist approach for callback URLs. Additionally, network-level controls such as web application firewalls and outbound traffic filtering can provide additional protection layers while more permanent solutions involve upgrading to patched versions or implementing proper input sanitization measures that align with secure coding practices recommended by OWASP and NIST guidelines. The absence of vendor response underscores the importance of proactive security monitoring and independent vulnerability management strategies for open source software deployments.