nosduco nforwardauth up to 1.5.0 Redirect r redirect

Summaryinfo

A vulnerability was found in nosduco nforwardauth up to 1.5.0. It has been rated as problematic. This issue affects some unknown processing of the component Redirect. Performing a manipulation of the argument r results in redirect. This vulnerability was named CVE-2026-81509. The attack may be initiated remotely. There is no available exploit. Upgrading the affected component is advised.

Detailsinfo

A vulnerability classified as problematic has been found in nosduco nforwardauth up to 1.5.0. This affects an unknown function of the component Redirect. The manipulation of the argument r with an unknown input leads to a redirect vulnerability. CWE is classifying the issue as CWE-601. A web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a Redirect. This simplifies phishing attacks. This is going to have an impact on integrity. The summary by CVE is:

nforwardauth is a forward auth service that allows the use of a single authentication middleware for multiple sites. Versions prior to 1.5.1 accept an unvalidated `r` query parameter on the `/login` endpoint and use them as the post-authentication redirect destination. An unauthenticated attacker can create a legitimate `nforwardauth` login URL that redirects a victim to an attacker-controlled website after the victim successfully authenticates. This issue may facilitate phishing and other social-engineering attacks by abusing the trust associated with the legitimate authentication domain. This vulnerability does not provide an unauthenticated ForwardAuth bypass. Version 1.5.1 contains a patch.

The advisory is shared at github.com. This vulnerability is uniquely identified as CVE-2026-81509 since 08/26/2026. The exploitability is told to be easy. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. It demands that the victim is doing some kind of user interaction. Technical details are known, but no exploit is available. MITRE ATT&CK project uses the attack technique T1204.001 for this issue.

Upgrading to version 1.5.1 eliminates this vulnerability.

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Vendor

• nosduco

Name

• nforwardauth

Version

• 1.0
• 1.1
• 1.2
• 1.3
• 1.4
• 1.5.0

Website

• Product: https://github.com/nosduco/nforwardauth/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion