CVE-2026-78145 in CTFd
Summary
by MITRE • 08/24/2026
A vulnerability has been found in CTFd up to 3.8.4. The affected element is the function _is_safe_url of the file CTFd/utils/validators/__init__.py. Such manipulation of the argument Next leads to open redirect. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The name of the patch is 5d8515842fd1ab2c3a9f2dde9ffca907aa334ea9. Upgrading the affected component is recommended.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 08/24/2026
The vulnerability identified in CTFd versions up to 3.8.4 represents a critical security flaw within the platform's URL validation logic, specifically located in the is_safe_url function found in the file CTFd/utils/validators/__init_.py. This component is responsible for validating redirect URLs during user authentication and session management flows. The core technical issue stems from an insufficient sanitization of the Next parameter passed to this validator. When a malicious actor supplies a crafted URL as the value for the Next argument, the validation logic fails to correctly distinguish between safe internal paths and external domains that could lead users away from the intended CTFd instance. This oversight allows an attacker to manipulate the redirect mechanism to point towards arbitrary external websites, effectively bypassing the security controls designed to keep users within the application's trusted domain context.
From a technical perspective, this flaw is classified as CWE-601: URL Redirection to Untrusted Site (Open Redirect). The vulnerability arises because the validation function does not adequately parse or restrict the scheme and host components of the provided URL. In many web applications, open redirect vulnerabilities are leveraged for phishing attacks where an attacker uses a trusted domain link to direct victims to a malicious site that mimics the legitimate application's login page. Since CTFd is often used in competitive programming environments involving sensitive credentials or personal information, such redirects can significantly erode user trust and facilitate credential harvesting campaigns. The presence of this flaw indicates a gap in input validation strategies where relative paths are accepted but absolute URLs with different hosts are not properly rejected when they should be.
The operational impact of this vulnerability is substantial due to its remote exploitability. An attacker does not require prior authentication or any special privileges to launch the attack, making it accessible to any internet user who can interact with the CTFd instance's login or registration endpoints. The exploitation process typically involves constructing a URL that includes the vulnerable Next parameter pointing to an external malicious domain. When a victim clicks this link and attempts to log in or register, they are redirected away from the legitimate platform after authentication steps have potentially been initiated. This can lead to data loss if sensitive information is entered on the phishing site before redirection occurs. Furthermore, because the exploit has been disclosed publicly, automated scanning tools and malicious actors may actively probe for this specific weakness in exposed CTFd instances, increasing the likelihood of successful compromise without targeted effort from attackers.
Mitigation strategies must focus on immediate remediation through software updates and enhanced input validation practices. The recommended course of action is to upgrade the affected component immediately by applying patch 5d8515842fd1ab2c3a9f2dde9ffca907aa334ea9, which addresses the logic errors in the _is_safe_url function. This update ensures that only URLs with hosts matching the application's configured domain are permitted for redirection. In addition to upgrading, administrators should implement strict allow-listing mechanisms for redirect targets rather than relying on block-lists or loose pattern matching. It is also advisable to monitor access logs for unusual patterns of redirects originating from authentication endpoints and to educate participants about verifying URL destinations before entering credentials. Aligning with ATT&CK techniques such as T1566.002 (Spearphishing Link), organizations should treat this vulnerability not just as a code defect but as an active vector for social engineering attacks that require both technical patching and user awareness to fully mitigate risk.