CVE-2026-81913 in Concrete CMS
Summary
by MITRE • 09/11/2026
Concrete CMS versions 9.5.0 through 9.5.2 are vulnerable to Open Redirect via the rcURL parameter. An attacker can craft a single link on the site's own domain that sends a user to an arbitrary external site immediately after authentication, facilitating phishing and credential theft. The same handling is present in the registration flow, giving a second entry point on sites with registration enabled. Concrete CMS versions prior to 9.5.0 do not include the rcURL parameter or this allowlist and are not affected. The Concrete CMS security team gave this vulnerability a CVSS v4.0 score of 5.3 with vector CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N. Thanks Michal M. for reporting.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/11/2026
Concrete CMS versions 9.5.0 through 9.5.2 contain a critical authentication bypass vulnerability classified as an Open Redirect flaw associated with the rcURL parameter. This security issue arises from insufficient validation of redirect targets within the application's login and registration workflows, allowing attackers to manipulate post-authentication navigation paths. The core technical failure lies in the lack of strict allowlisting or rigorous domain verification for URLs passed via the rcURL query string during authentication processes. When a user attempts to log in or register on an affected instance, the system accepts arbitrary external domains as valid redirect targets without proper sanitization checks that would restrict redirection solely to trusted internal paths or explicitly whitelisted domains. This deficiency enables an adversary to construct malicious links hosted on the same domain as the vulnerable Concrete CMS installation that seamlessly transition users from a legitimate authentication page to a phishing site immediately after credentials are submitted.
The operational impact of this vulnerability is significant, particularly in environments where user registration is enabled and social engineering attacks are prevalent. By exploiting the rcURL parameter, an attacker can create a deceptive link that appears to originate from the trusted Concrete CMS domain but ultimately directs the victim to a malicious external site designed to mimic legitimate services or harvest credentials. This technique facilitates sophisticated phishing campaigns because users often trust URLs originating from familiar domains they recognize as part of their organization's infrastructure. The presence of this flaw in both the login and registration flows provides multiple entry points for exploitation, increasing the attack surface significantly. Since the redirect occurs immediately after authentication, victims may believe they have successfully logged in while actually being redirected to a fraudulent environment controlled by the attacker, leading to potential credential theft, session hijacking, or further malware distribution depending on the nature of the phishing site deployed.
From a classification perspective, this vulnerability aligns with CWE-601, which defines Open Redirect as a type of web application flaw where an application redirects users to URLs provided in user input without proper validation. The attack vector corresponds closely to ATT&CK technique T1566.002, specifically Spearphishing Link, wherein attackers send links that redirect victims to malicious sites for credential harvesting or malware installation. Although the CVSS v4.0 score assigned by the Concrete CMS security team is 5.3 indicating a medium severity rating due to low confidentiality and integrity impacts on the system itself rather than direct compromise of server resources, the practical risk remains high because it leverages user trust and facilitates secondary attacks such as credential theft or malware delivery. The vector CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N reflects that the attack requires no authentication, has low complexity, involves user interaction through phishing links, and results in limited integrity loss without affecting availability or confidentiality of the underlying system directly.
Mitigation strategies must focus on immediate patching and defensive configuration changes to prevent exploitation until updates are applied universally across all affected instances. Organizations running Concrete CMS versions 9.5.0 through 9.5.2 should upgrade to version 9.5.3 or later, which includes the necessary fixes for this allowlist implementation issue. For environments where immediate patching is not feasible due to operational constraints, administrators can implement web application firewall rules that detect and block requests containing suspicious patterns in the rcURL parameter, particularly those attempting to redirect to external domains with different hostnames than the originating site. Additionally, enforcing strict Content Security Policy headers that restrict navigation targets and educating users about verifying URL destinations post-login can reduce successful exploitation rates. It is also advisable to disable public registration if not strictly required by business needs, thereby removing one of the two primary attack vectors associated with this vulnerability. Continuous monitoring for unusual login patterns followed by immediate external redirects should be integrated into security operations center workflows to detect potential attempts in real time and respond proactively before credential data is compromised.