CVE-2025-54066— DiracX-Web login page has Open Redirect vulnerability
Quick assessment
Affected
DIRACGrid diracx-web
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
DiracX-Web是DIRAC Project开源的一个DiracX的用户界面。 DiracX-Web 0.1.0-a8之前版本存在输入验证错误漏洞，该漏洞源于重定向字段未验证，可能导致钓鱼攻击。
Possible ATT&CK Techniques 3 AI
T1190 · Exploit Public-Facing Application T1189 · Drive-by Compromise T1566.001 · Spearphishing Attachment
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2025-54066
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
DiracX-Web login page has Open Redirect vulnerability
Source: CVE Program / CVE List V5
Vulnerability Description
DiracX-Web is a web application that provides an interface to interact with the DiracX services. Prior to version 0.1.0-a8, an attacker can forge a request that they can pass to redirect an authenticated user to another arbitrary website. In the login page, DiracX-Web has a `redirect` field which is the location where the server will redirect the user. This URI is not verified, and can be an arbitrary URI. Paired with a parameter pollution, an attacker can hide their malicious URI. This could be used for phishing, and extract new data (such as redirecting to a new "log in" page, and asking another time credentials). Version 0.1.0-a8 fixes this vulnerability.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
指向未可信站点的URL重定向(开放重定向)
Source: CVE Program / CVE List V5
Vulnerability Title
DiracX-Web 输入验证错误漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
DiracX-Web是DIRAC Project开源的一个DiracX的用户界面。 DiracX-Web 0.1.0-a8之前版本存在输入验证错误漏洞，该漏洞源于重定向字段未验证，可能导致钓鱼攻击。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| DIRACGrid | diracx-web | < 0.1.0-a8 | - |
|
II. Public POCs for CVE-2025-54066
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2025-54066
请登录查看更多情报信息。
IV. Related Vulnerabilities
Same vendor: DIRACGrid
-
CVE-2026-61668
DIRAC: Pilot code downloaded over unverified HTTPS connectio -
CVE-2026-61667
DIRAC: RCE in FileCatalog DatasetManager via SQL injection + -
CVE-2026-45579
DIRAC: RCE in RequestManager due to eval on untrusted input -
CVE-2024-29905
DIRAC: Unauthorized users can read proxy contents during gen -
CVE-2024-24825
TokenManager not checking permissions on cached tokens in DI
Same weakness: CWE-601
-
CVE-2026-54724
Kiwi TCMS: Open Redirect via unvalidated next parameter in a -
CVE-2026-89307
HTML injection allows open redirection in WordPress theme de -
CVE-2026-91772
Halo through 2.26.1 Open Redirect via Unvalidated URI Parame -
CVE-2026-13277
Security vulnerabilities have been addressed in IBM Verify I -
CVE-2026-15412
IBM WebSphere Application Server prior to 9.0.5.29 and 8.5.5
V. Comments for CVE-2025-54066
No comments yet