CVE-2026-73671 in CMS Community Edition
Summary
by MITRE • 08/13/2026
Saurus CMS Community Edition contains an unauthenticated open redirect vulnerability in the logout handling code in classes/port.inc.php, where the url parameter supplied via GET or POST is passed directly to the Location header without domain allowlist, scheme validation, or relative path enforcement. Attackers can craft a malicious logout URL containing an arbitrary external domain or javascript: URI scheme to redirect authenticated users to attacker-controlled phishing pages after session destruction, enabling credential theft and OAuth redirect abuse.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 08/13/2026
The Saurus CMS Community Edition vulnerability represents a critical security flaw in the authentication handling mechanism that undermines user session integrity and exposes organizations to sophisticated social engineering attacks. This issue resides within the logout functionality code located in classes/port.inc.php where the application fails to properly validate user-supplied URL parameters during the logout process. The vulnerability manifests when the url parameter from either GET or POST requests is directly incorporated into the HTTP Location header without any form of input sanitization or validation, creating an open redirect condition that can be exploited by malicious actors to manipulate user navigation.
The technical implementation of this flaw stems from a complete absence of domain allowlisting, scheme validation, and relative path enforcement mechanisms within the logout handler. When users initiate a logout action, the application accepts any URL provided in the url parameter and immediately uses it to construct the redirect response header. This lack of input validation creates an environment where attackers can inject arbitrary domains or malicious URI schemes such as javascript: into the redirect location, effectively bypassing the intended session termination process. The vulnerability operates at the HTTP protocol level through improper header construction, making it particularly dangerous because it occurs after authentication has already been established but before the session is fully terminated.
From an operational perspective, this vulnerability enables sophisticated attack vectors that can result in significant security breaches and data compromise. Attackers can craft malicious logout URLs that appear legitimate to users while redirecting them to phishing pages designed to capture credentials or other sensitive information. The impact extends beyond simple credential theft as the vulnerability also enables OAuth redirect abuse, where authenticated users might be redirected to attacker-controlled domains during the authentication flow, potentially compromising third-party service integrations. This type of attack can be particularly devastating in enterprise environments where Saurus CMS is used for content management and user authentication.
The vulnerability aligns with CWE-601 Open Redirect weakness category which specifically addresses insecure redirection mechanisms that allow attackers to redirect users to malicious sites. From the MITRE ATT&CK framework perspective, this issue maps to techniques involving credential access through social engineering and session hijacking, potentially enabling lateral movement within compromised networks. Organizations utilizing Saurus CMS Community Edition face elevated risk of targeted attacks where attackers exploit this vulnerability to establish persistent access through credential theft or to compromise user sessions across multiple applications that rely on the same authentication infrastructure.
Mitigation strategies should focus on implementing strict input validation mechanisms for all URL parameters used in redirect operations, including domain allowlisting, scheme restriction to http/https protocols only, and absolute path enforcement. Organizations should implement comprehensive parameter sanitization within the logout handler to ensure that any external URLs are validated against a predefined whitelist of trusted domains before being used in Location headers. Additionally, implementing proper session invalidation procedures that do not rely on external redirects, or using internal redirect mechanisms with strict validation, would effectively eliminate this vulnerability. Regular security assessments and input validation testing should be conducted to prevent similar issues from emerging in other components of the application stack.