Impact
An Open Redirect vulnerability (CWE-601) affects BunkerWeb UI 1.6.X (< 1.6.4).
The flaw is located in the /loading endpoint, which mishandles the next parameter.
Attackers can craft protocol-relative URLs (e.g., ?next=//malicious.site/) that cause users—authenticated or not—to be redirected to arbitrary external domains.
This can be abused in phishing scenarios, tricking users into trusting malicious sites.
Patches
BunkerWeb 1.6.4 integrates a patch to fix the vulnerability.
References
Impact
An Open Redirect vulnerability (CWE-601) affects BunkerWeb UI 1.6.X (< 1.6.4).
The flaw is located in the
/loadingendpoint, which mishandles thenextparameter.Attackers can craft protocol-relative URLs (e.g.,
?next=//malicious.site/) that cause users—authenticated or not—to be redirected to arbitrary external domains.This can be abused in phishing scenarios, tricking users into trusting malicious sites.
Patches
BunkerWeb 1.6.4 integrates a patch to fix the vulnerability.
References