Open Redirect Vulnerability in Leantime Product by Leantime

CVE-2026-66414

What is CVE-2026-66414?

Leantime version 3.6.2 has an open redirect vulnerability in its Login controller. It allows unauthenticated attackers to manipulate the redirectUrl POST parameter, leading authenticated users to unintended external websites. By exploiting this vulnerability, attackers can create malicious login URLs that exploit the bypass of FILTER_SANITIZE_URL validation. This can facilitate phishing attacks or the theft of user credentials, posing a significant risk to the security of users who may be redirected to attacker-controlled sites.

References