CVE-2024-58389

6.1Medium

Published 12 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash

6.1Medium

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: Required
Impact: Limited impact
Weakness: CWE-601

Impact

Remote attackers can redirect users to malicious external sites right after they log in, using phishing links with crafted 'next' parameters. This requires an unauthenticated victim to click a malicious link and successfully authenticate.

Root cause

The authentication handlers in panel/auth.py store the 'next' query parameter in a cookie without validating that the destination URL is local.

Affected systems

HoloViz Panel from 1.2.2 before 1.9.0

CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Fix & remediation

Upgrade to HoloViz Panel version 1.9.0 or later. If patching immediately is not possible, avoid using affected built-in login handlers (BasicLoginHandler and PasswordLoginHandler) or place the application behind a reverse proxy that sanitizes or strips external URLs from the 'next' query parameter.

shell

$ pip install --upgrade 'panel>=1.9.0'

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

HoloViz Panel from 1.2.2 before 1.9.0 contains an open redirect vulnerability in panel/auth.py that allows remote attackers to redirect users by supplying an unvalidated next query parameter. BasicLoginHandler and PasswordLoginHandler store the parameter in a next_url cookie, so crafted login links send victims to attacker-controlled external sites after successful login.

References

Source: nvd.nist.gov/vuln/detail/CVE-2024-58389