Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-73671— Saurus CMS Unauthenticated Open Redirect via logout url parameter

Quick assessment

Affected
Saurus Saurus CMS Community Edition
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Saurus CMS 社区版在 中的登出处理代码存在一个未授权的重定向漏洞。攻击者可以通过 GET 或 POST 参数传入一个恶意构造的 URL，该 URL 会被直接赋值到 HTTP 响应头的 Location 字段中，而系统并未对目标域名进行白名单校验、未对 URI 方案（scheme）进行验证，也未强制要求使用相对路径。 攻击者可构造包含任意外部域名或 URI 方案的恶意登出链接，在用户会话销毁后，将已认证的用户重定向至攻击者控制的钓鱼页面，从而导致凭据窃取及 OAuth 重定向滥用等安全风险。

CVSS 6.1 · Medium EPSS 0.31% · P22

Affected Version Matrix 1

VendorProduct Version RangeStatus
Saurus Saurus CMS Community Edition ≤ d886e5b affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-73671

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Saurus CMS Unauthenticated Open Redirect via logout url parameter
Source: CVE Program / CVE List V5
Vulnerability Description
Saurus CMS Community Edition contains an unauthenticated open redirect vulnerability in the logout handling code in classes/port.inc.php, where the url parameter supplied via GET or POST is passed directly to the Location header without domain allowlist, scheme validation, or relative path enforcement. Attackers can craft a malicious logout URL containing an arbitrary external domain or javascript: URI scheme to redirect authenticated users to attacker-controlled phishing pages after session destruction, enabling credential theft and OAuth redirect abuse.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
指向未可信站点的URL重定向(开放重定向)
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
Saurus Saurus CMS Community Edition 0 ~ d886e5b -

II. Public POCs for CVE-2026-73671

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-73671

请登录查看更多情报信息。

Vendor Advisories for CVE-2026-73671 (1)

Proof of Concept for CVE-2026-73671 (1)

Other References for CVE-2026-73671 (1)

IV. Related Vulnerabilities

Same product: Saurus CMS Community Edition
Same vendor: Saurus
Same weakness: CWE-601

V. Comments for CVE-2026-73671

No comments yet

Leave a comment