{"id":"CVE-2026-81509","aliases":[],"cve":{"records":[{"id":"CVE-2026-81509","source":"GitHub_M","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-08-26T20:58:58.084Z","published":"2026-10-26T17:19:15.467Z","modified":"2026-10-26T19:34:58.155Z"}],"publishers":[{"name":"GitHub_M","role":"CNA","organizationId":"a0819718-46f1-4df5-94e2-005712e83aaa","modified":"2026-10-26T18:12:30.433Z"},{"name":"CISA-ADP","role":"ADP","organizationId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","modified":"2026-10-26T19:34:58.155Z"}],"references":[{"url":"https://github.com/nosduco/nforwardauth/security/advisories/GHSA-q64r-v7j5-6hfg","tags":["x_refsource_CONFIRM"],"source":"GitHub_M"},{"url":"https://github.com/nosduco/nforwardauth/pull/71","tags":["x_refsource_MISC"],"source":"GitHub_M"},{"url":"https://github.com/nosduco/nforwardauth/commit/664f2602f9e1459558d1c4c55019f6d48bc64c43","tags":["x_refsource_MISC"],"source":"GitHub_M"},{"url":"https://github.com/nosduco/nforwardauth/releases/tag/v1.5.1","tags":["x_refsource_MISC"],"source":"GitHub_M"}],"weaknesses":[{"id":"CWE-601","description":"CWE-601: URL Redirection to Untrusted Site ('Open Redirect')","source":"GitHub_M"}],"applicability":[],"prioritization":[{"source":"CISA-ADP","type":"SSVC","role":"CISA Coordinator","timestamp":"2026-10-26T19:29:40.719883Z","decisions":[{"name":"Exploitation","value":"none"},{"name":"Automatable","value":"no"},{"name":"Technical Impact","value":"partial"}]}]},"title":"nforwardauth: Unvalidated r parameter allows post-authentication open redirect","titleSource":"GitHub_M","descriptionSource":"GitHub_M","description":"nforwardauth is a forward auth service that allows the use of a single authentication middleware for multiple sites. Versions prior to 1.5.1 accept an unvalidated `r` query parameter on the `/login` endpoint and use them as the post-authentication redirect destination. An unauthenticated attacker can create a legitimate `nforwardauth` login URL that redirects a victim to an attacker-controlled website after the victim successfully authenticates. This issue may facilitate phishing and other social-engineering attacks by abusing the trust associated with the legitimate authentication domain. This vulnerability does not provide an unauthenticated ForwardAuth bypass. Version 1.5.1 contains a patch.","score":6.1,"severity":"medium","published":"2026-10-26T17:19:15.467Z","modified":"2026-10-26T19:34:58.155Z","withdrawn":false,"knownExploited":false,"affected":[],"products":[{"vendor":"nosduco","name":"nforwardauth","platforms":[],"versions":[{"version":"< 1.5.1","status":"affected"}],"cpes":[],"source":"GitHub_M","url":"https://www.cve.org/CVERecord?id=CVE-2026-81509"}],"remediation":[],"references":["https://github.com/nosduco/nforwardauth/security/advisories/GHSA-q64r-v7j5-6hfg","https://github.com/nosduco/nforwardauth/pull/71","https://github.com/nosduco/nforwardauth/commit/664f2602f9e1459558d1c4c55019f6d48bc64c43","https://github.com/nosduco/nforwardauth/releases/tag/v1.5.1"],"sources":[{"name":"CVE","id":"CVE-2026-81509","modified":"2026-10-26T19:34:58.155Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-81509"}],"assessments":[{"source":"GitHub_M","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","score":6.1}],"sourceAffected":[],"observedAt":"2026-10-29T14:44:34.730Z","kev":{"status":"not-listed","checkedAt":"2026-10-31T00:45:31.953Z"},"coverage":[{"source":"NVD","status":"not-checked"},{"source":"GHSA","status":"not-checked"},{"source":"EUVD","status":"not-checked"},{"source":"EPSS","status":"not-checked"}],"evidence":[],"aiSummary":{"text":"nforwardauth versions prior to 1.5.1 have an open redirect vulnerability due to an unvalidated `r` query parameter on the `/login` endpoint, allowing an unauthenticated attacker to redirect victims to an attacker-controlled website after successful authentication. This may facilitate phishing attacks. The vulnerability is patched in version 1.5.1.","model":"@cf/meta/llama-3.3-70b-instruct-fp8-fast","generatedAt":"2026-10-30T09:17:11.324Z","sources":[{"name":"CVE","url":"https://www.cve.org/CVERecord?id=CVE-2026-81509"}]}}