CVE-2025-30164 Icinga Web 2 has open redirect on login page

Medium 4.1 Published 26 Mar 2025 Updated 12 May 2025

An attacker can craft a URL to redirect authenticated Icinga Web 2 users to arbitrary external locations, potentially facilitating phishing attacks.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: A user has to click or open something
Fix: Available

What is CVE-2025-30164?

CVE-2025-30164 is a medium-severity vulnerability in icingaweb2, published on 26 Mar 2025. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.

Official description

Icinga Web 2 is an open source monitoring web interface, framework and command-line interface. A vulnerability in versions prior to 2.11.5 and 2.12.13 vulnerability allows an attacker to craft a URL that, once visited by an authenticated user (or one that is able to authenticate), allows to manipulate the backend to redirect the user to any location. This issue has been resolved in versions 2.11.5 and 2.12.3 of Icinga Web 2. No known workarounds are available.

Weakness: CWE-601

Which versions are affected by CVE-2025-30164?

It affects 1 product.

Products include Icinga Icinga Web 2.

How do I fix CVE-2025-30164?

Upgrade to a fixed version.

Is CVE-2025-30164 being exploited?

There is no known exploitation of CVE-2025-30164 in the wild and no public exploit code.

Sources

Also known as DEBIAN-CVE-2025-30164, GHSA-8r73-6686-wv8q, UBUNTU-CVE-2025-30164.