{"id":"CVE-2024-12141","kind":"vulnerability","aliases":["CVE-2024-12141"],"related":[],"title":"Unnamed product: callback URL validation flaw enables redirects to phishing pages","description":"The product fails to sufficiently validate callback URLs, allowing them to be manipulated with malicious payloads when processed through a weak regular expression or when validation is omitted.\n\nAn attacker can exploit this by crafting a link that appears legitimate but redirects users to an attacker-controlled page. This redirection facilitates phishing attacks, enabling the harvesting of sensitive user information, potentially leading to unauthorized access or data theft.","summary":"The product does not properly validate callback URLs, so a crafted link can send users to an attacker-controlled page. An attacker can use that redirect to run phishing and harvest sensitive user information.","severity":"medium","cvss":4.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["other","unknown-product"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-02T13:17:29+00:00","first_seen_at":"2026-11-02T13:23:15+00:00","triaged_at":"2026-11-02T13:24:57+00:00","updated_at":"2026-11-02T13:24:57+00:00","category":"other","confidence":0.3,"triage":{"at":"2026-11-02T13:24:57Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Unnamed product: callback URL validation flaw enables redirects to phishing pages","impact":"medium","summary":"The product does not properly validate callback URLs, so a crafted link can send users to an attacker-controlled page. An attacker can use that redirect to run phishing and harvest sensitive user information.","audience":"businesses","category":"other","nicknames":[],"who_cares":["unknown-product"],"confidence":0.3,"fix_status":"unknown","needs_auth":"unknown","worst_case":"users phished into giving away sensitive account information","analyst_note":"Identify the affected product and versions from the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2024-12141 and find the fixed release.","how_to_check":"unknown","plain_action":"","needs_analyst":true,"not_affected_if":[],"who_is_affected":"The sources do not name the product, its versions, or the feature that handles callback URLs, so exposure cannot be determined from them. Teams should look for any login or OAuth-style flow that accepts a redirect or callback URL parameter.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.00063,"input_tokens":4166,"output_tokens":426,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-12141':14A,17A '-2024':13A,16A 'access':122C 'allow':65C 'appear':95C 'attack':40B,44B,86C,103C,110C 'attacker-control':39B,102C 'callback':3A,28B,63C 'control':41B,104C 'craft':32B,91C 'cve':12A,15A 'data':124C 'enabl':7A,111C 'exploit':88C 'express':79C 'facilit':108C 'fail':59C 'flaw':6A 'harvest':53B,113C 'inform':56B,117C 'lead':119C 'legitim':96C 'link':33B,93C 'malici':71C 'manipul':69C 'omit':84C 'page':11A,42B,105C 'payload':72C 'phish':10A,51B,109C 'potenti':118C 'process':74C 'product':2A,21B,23B,58C 'proper':26B 'redirect':8A,48B,98C,107C 'regular':78C 'run':50B 'send':35B 'sensit':54B,115C 'suffici':61C 'theft':125C 'unauthor':121C 'unknown':20B 'unknown-product':19B 'unnam':1A 'url':4A,29B,64C 'use':46B 'user':36B,55B,99C,116C 'valid':5A,27B,62C,82C 'weak':77C","nicknames":[],"mitigations":[],"who_affected":"The sources do not name the product, its versions, or the feature that handles callback URLs, so exposure cannot be determined from them. Teams should look for any login or OAuth-style flow that accepts a redirect or callback URL parameter.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["medium","other","unknownproduct"],"first_public_at":"2026-11-02T13:17:29+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","cvss_by":"ed10eef1-636d-4fbe-9993-6890dfa878f8","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2024-12141","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-12141","severity":null,"published_at":"2026-11-02T13:17:29+00:00","modified_at":"2026-11-02T13:17:30+00:00","first_seen_at":"2026-11-02T13:23:15+00:00","fetched_at":"2026-11-02T13:23:15+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}