CVE-2026-93871 Cotonti through 1.0.0 Stored Open Redirect via Page redir: Prefix
Authenticated users can store malicious redirects in Cotonti pages, enabling phishing attacks against visitors on trusted domains.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2026-93871?
CVE-2026-93871 is a medium-severity vulnerability in Cotonti, published on 18 Sep 2026. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
Cotonti through 1.0.0 fails to validate redirect destinations in page bodies prefixed with redir:, allowing authenticated users with page creation or edit permissions to store redirects to arbitrary external hosts. Attackers can craft pages on trusted domains that redirect visitors to malicious sites for phishing attacks without administrative privileges.
Weakness: CWE-601
Which versions are affected by CVE-2026-93871?
How do I fix CVE-2026-93871?
No fix has been published for CVE-2026-93871 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-93871 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-93871 exists.
Sources
Also known as GHSA-gp9j-h9gm-p3q2.