Live › vulnerability › CVE-2024-12141
The product does not properly validate callback URLs, so a crafted link can send users to an attacker-controlled page. An attacker can use that redirect to run phishing and harvest sensitive user information.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-02 13:23 UTC. All times on this page are UTC.
The sources do not name the product, its versions, or the feature that handles callback URLs, so exposure cannot be determined from them. Teams should look for any login or OAuth-style flow that accepts a redirect or callback URL parameter.
No product ranges from the sources yet.
Unknown from the sources.
No fix yet, per the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
The product fails to sufficiently validate callback URLs, allowing them to be manipulated with malicious payloads when processed through a weak regular expression or when validation is omitted.
An attacker can exploit this by crafting a link that appears legitimate but redirects users to an attacker-controlled page. This redirection facilitates phishing attacks, enabling the harvesting of sensitive user information, potentially leading to unauthorized access or data theft.
This page as .md · .json · in your agent: get_signal("CVE-2024-12141")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.