Unauthenticated Redirect Vulnerability in Splunk Enterprise and Cloud Platform

CVE-2025-20378

What is CVE-2025-20378?

In specific versions of Splunk Enterprise and Splunk Cloud Platform, an unauthenticated attacker could exploit a flaw in the return_to parameter of the login endpoint. By crafting a malicious URL, the attacker could lead authenticated users to an unvalidated redirect to a potentially harmful external site. Exploitation relies on tricking users into clicking the malicious link, requiring social engineering rather than direct attack methods.

References