Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-58450— Invoice Ninja 5.13.26 - Open Redirect in Client Portal Login via intended Parameter

Quick assessment

Affected
invoiceninja invoiceninja
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Invoice Ninja是Invoice Ninja公司开源的一个免费发票软件。 Invoice Ninja 5.13.26及之前版本存在输入验证错误漏洞，该漏洞源于客户端门户登录存在开放重定向漏洞，攻击者可通过向查询参数注入恶意值，使未经身份验证的攻击者将经过身份验证的用户重定向至攻击者控制的外部URL，可能导致钓鱼攻击。

CVSS 4.3 · Medium EPSS 0.29% · P22

Affected Version Matrix 1

VendorProduct Version RangeStatus
invoiceninja invoiceninja ≤ 5.13.26 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-58450

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Invoice Ninja 5.13.26 - Open Redirect in Client Portal Login via intended Parameter
Source: CVE Program / CVE List V5
Vulnerability Description
Invoice Ninja through 5.13.26 contains an open redirect vulnerability in the client portal login that allows unauthenticated attackers to redirect authenticated victims to attacker-controlled external URLs by injecting a malicious value into the intended query parameter. Attackers can craft a client login link with an external URL in the intended parameter, which is stored in the session without host validation and emitted verbatim via a bare redirect in the ContactLoginController authenticated() handler after the victim completes a legitimate login, enabling phishing attacks.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
指向未可信站点的URL重定向(开放重定向)
Source: CVE Program / CVE List V5
Vulnerability Title
Invoice Ninja 输入验证错误漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Invoice Ninja是Invoice Ninja公司开源的一个免费发票软件。 Invoice Ninja 5.13.26及之前版本存在输入验证错误漏洞，该漏洞源于客户端门户登录存在开放重定向漏洞，攻击者可通过向查询参数注入恶意值，使未经身份验证的攻击者将经过身份验证的用户重定向至攻击者控制的外部URL，可能导致钓鱼攻击。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
invoiceninja invoiceninja 0 ~ 5.13.26 -

II. Public POCs for CVE-2026-58450

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-58450

请登录查看更多情报信息。

Vendor Advisories for CVE-2026-58450 (1)

Proof of Concept for CVE-2026-58450 (1)

IV. Related Vulnerabilities

Same product: invoiceninja
Same vendor: invoiceninja
Same weakness: CWE-601