CVE-2026-93871 in Cotonti
Summary
by MITRE • 09/18/2026
Cotonti through 1.0.0 fails to validate redirect destinations in page bodies prefixed with redir:, allowing authenticated users with page creation or edit permissions to store redirects to arbitrary external hosts. Attackers can craft pages on trusted domains that redirect visitors to malicious sites for phishing attacks without administrative privileges.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/18/2026
The vulnerability identified in Cotonti versions through 1.0.0 represents a significant security flaw rooted in insufficient input validation regarding URL redirection mechanisms. Specifically, the application fails to properly sanitize or validate destination URLs when they are embedded within page bodies using the redir: prefix. This design oversight allows authenticated users who possess permissions to create or edit pages to inject arbitrary external host addresses into their content. The core technical failure lies in the absence of a whitelist mechanism or strict domain validation logic that would restrict redirects to trusted internal domains, thereby permitting the storage and execution of links pointing to any externally controlled server.
From an operational perspective, this flaw enables attackers with legitimate but limited user accounts to compromise the integrity and trustworthiness of the web application without requiring administrative privileges. By crafting pages on a trusted domain, these users can effectively turn the Cotonti instance into a phishing vector. When unsuspecting visitors access these compromised pages, they are seamlessly redirected to malicious sites designed for credential harvesting or malware distribution. This capability undermines the security boundary between standard user roles and administrators, as it allows lower-privileged entities to execute actions typically reserved for high-level users, such as manipulating site navigation and potentially facilitating social engineering attacks against other users of the platform.
This vulnerability aligns with Common Weakness Enumeration (CWE) category CWE-601, which describes URL Redirection to Untrusted Site ('Open Redirect'). The exploitation technique maps directly to MITRE ATT&CK tactic TA0001 Initial Access and specifically the Tactic T1583 Acquire Infrastructure, as attackers use trusted domains to host phishing infrastructure. Furthermore, it relates to CWE-20 Improper Input Validation because the system accepts user-supplied input without adequate verification of its safety or intended destination. The impact extends beyond simple redirection; it facilitates credential theft and potentially malware delivery by leveraging the reputation and trust associated with the legitimate Cotonti domain.
To mitigate this risk, immediate remediation should focus on implementing strict allow-listing for redirect destinations. Developers must ensure that any URL processing logic validates the target host against a predefined list of trusted domains before executing the redirection. Additionally, input validation routines should be strengthened to reject or escape special characters and protocols in user-supplied fields unless explicitly permitted by business requirements. Implementing Content Security Policy (CSP) headers can also help mitigate some downstream effects by restricting where browsers are allowed to navigate via script-driven redirects. Regular security audits of authentication and authorization modules, along with enforcing the principle of least privilege for page editing permissions, will further reduce the attack surface available to malicious insiders or compromised accounts.