Open Redirect Vulnerability in Diem Project Sign-In Component

CVE-2026-112040

What is CVE-2026-112040?

An open redirect vulnerability has been identified in the Diem Project's Sign-In component. This issue arises from improper validation of the 'Referer' argument in the BasedmUserActions.class.php file. The flaw allows malicious actors to redirect users to unintended locations, potentially facilitating phishing attacks or other security threats. The vulnerability is remotely exploitable and was disclosed publicly, prompting concern over its impact. Although reported to the project maintainers, no response has been documented. Given the rolling release strategy of the Diem Project, specific version numbers for patches or updates are not explicitly defined.

References