CVE-2026-66414 in Leantime
Summary
by MITRE • 07/30/2026
Leantime 3.6.2 contains an open redirect vulnerability in the Login controller that allows unauthenticated attackers to redirect authenticated users to arbitrary external sites by manipulating the redirectUrl POST parameter. Attackers can craft a malicious login URL with a tampered redirectUrl value that bypasses FILTER_SANITIZE_URL validation to redirect victims to attacker-controlled sites for phishing or credential theft.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 07/30/2026
The vulnerability in Leantime version 3.6.2 represents a critical open redirect flaw within the Login controller that exposes the application to sophisticated social engineering attacks. This weakness allows unauthenticated attackers to manipulate the redirectUrl POST parameter during authentication processes, creating a pathway for malicious redirection that can compromise user security. The vulnerability specifically arises from inadequate input validation where the FILTER_SANITIZE_URL function fails to properly sanitize user-supplied redirect parameters, enabling attackers to inject crafted URLs that bypass security checks.
The technical implementation of this flaw stems from insufficient sanitization and validation of user-controllable inputs within the authentication flow. When users attempt to log in, the system accepts a redirectUrl parameter that should ideally validate against a predefined whitelist of allowed domains or properly sanitize all external URL references. However, the current implementation relies on FILTER_SANITIZE_URL which, while designed to remove dangerous characters from URLs, does not adequately prevent attackers from crafting malicious redirection payloads that can contain encoded or obfuscated elements. This validation bypass allows attackers to inject URLs with protocols such as javascript: or data: schemes that can execute malicious code or redirect users to phishing sites.
The operational impact of this vulnerability extends beyond simple redirection attacks and creates significant risks for both individual users and organizational security posture. Authenticated users who are tricked into clicking malicious login links could be redirected to fully functional phishing pages that mimic legitimate services, potentially leading to credential theft, session hijacking, or further exploitation. The attack vector is particularly dangerous because it leverages the trust users place in legitimate authentication flows, making social engineering attacks more effective and harder to detect. Security researchers have identified this pattern as consistent with common attack techniques documented in the attack phase of the kill chain where adversaries focus on establishing initial access through deceptive means.
Organizations using Leantime 3.6.2 face substantial risk from this vulnerability, particularly in environments where users may be targeted through spear-phishing campaigns or social engineering attacks that exploit the authentication redirect functionality. The open redirect issue creates a persistent security gap that can be exploited across multiple attack scenarios including credential harvesting, malware distribution, and advanced persistent threat campaigns. This vulnerability aligns with CWE-601 open redirect weaknesses and maps to attack techniques in the MITRE ATT&CK framework under Initial Access and Credential Access phases where attackers leverage trusted authentication mechanisms to gain unauthorized access.
Mitigation strategies should focus on implementing robust input validation and output encoding for all redirect parameters, establishing strict domain whitelists for redirection targets, and employing proper URL sanitization routines that go beyond basic filtering functions. Security teams should immediately implement parameter validation that ensures all redirect URLs are either internal or explicitly authorized external domains, while also considering the implementation of additional security headers such as Content Security Policy to prevent unauthorized redirections. Regular security assessments and code reviews should include thorough examination of authentication flows and redirect mechanisms to identify similar vulnerabilities in other application components. The vulnerability also underscores the importance of maintaining current software versions and implementing proper security controls during development cycles to prevent such issues from being introduced into production environments.