CVE-2026-103523
6.1MediumPublished 12 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
- Impact
- Limited impact
- Weakness
- CWE-601
Impact
Attackers can redirect authenticated users to malicious external sites to facilitate phishing or credential theft. This requires tricking a victim into opening a specially crafted link and submitting the address creation form.
Root cause
The application fails to validate the origin of the destination URL supplied in the 'next' parameter upon address submission.
Affected systems
Thelia v2.6.0
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Fix & remediation
Upgrade to a patched version once released by the vendor; if waiting for a patch, configure a reverse proxy or WAF rule to block or sanitize the 'next' parameter when it contains external URLs or absolute schemes.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
Thelia v2.6.0 contains an open redirect vulnerability in its address creation workflow. After a user accesses a crafted URL and successfully submits the “Add New Address” form, the application redirects them to the URL specified in the `next` parameter. Because the application does not validate whether the destination belongs to the same origin or an approved allowlist, an attacker can supply an arbitrary external URL and redirect users to an attacker-controlled website.