CVE-2026-18721
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk16th percentile - higher than 16% of all known CVEs
Summary
A vulnerability has been found in kalcaddle kodbox 1.67 Build 02 in the file /user/sso/apiLogin of the SSO API Login component. Manipulation of the argument callbackUrl leads to open redirect. The attack can be initiated remotely, and the exploit has been publicly disclosed.
Risk Assessment
Open redirect can be used for phishing, as users may be redirected to malicious sites, potentially leading to credential theft.
Recommendation
Restrict or validate the callbackUrl argument to prevent redirects to external domains. Also monitor vendor updates.
Other vulnerabilities in kodbox
See all- CVE-2026-5618Medium
In kodbox up to version 1.64, a Server-Side Request Forgery (SSRF) vulnerability exists in the shareMake/shareCheck component. Manipulating the siteFrom/siteTo arguments allows server-side requests. The attack is remote but difficult. The exploit is public. The vendor did not respond.
- CVE-2024-51037Medium
A vulnerability in kodbox version 1.52.04 and earlier allows a remote attacker to obtain sensitive information via the captcha feature in the password reset function.
Original NVD description (English source)
A vulnerability has been found in kalcaddle kodbox 1.67 Build 02. This issue affects some unknown processing of the file /user/sso/apiLogin of the component SSO API Login. The manipulation of the argument callbackUrl leads to open redirect. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.