Live › vulnerability › CVE-2026-112040
Go to dashboardThe diem PHP project's sign-in module does not validate the Referer argument, so a crafted link can send a user to an attacker-chosen site after login. An attacker can use this to build convincing phishing links that appear to come from the legitimate application.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Teams running the diem-project diem application with the dmUser sign-in plugin exposed to users on the internet. The sources say the project has not responded and no fixed release is named, so mitigation likely requires a local code change or a redirect allowlist. Teams not running diem can skip it.
No product ranges from the sources yet.
dmCorePlugin/plugins/dmUserPlugin code (unknown version range; the sources say versions cannot be specified)dmCorePlugin/plugins/dmUserPlugin/modules/dmUser/lib/BasedmUserActions.class.php for unvalidated use of the Referer valueReferer value redirects off-siteUnknown from the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A vulnerability was determined in diem-project diem up to 116974edfb9a5b8bd69cb13586dc62bcdbb485ad. This affects an unknown part of the file dmCorePlugin/plugins/dmUserPlugin/modules/dmUser/lib/BasedmUserActions.class.php of the component Sign-In. This manipulation of the argument Referer causes open redirect. The attack is possible to be carried out remotely. The exploit has been publicly disclosed and may be utilized. This product adopts a rolling release strategy to maintain continuous delivery. Therefore, version details for affected or updated releases cannot be specified. The project was informed of the problem early through an issue report but has not responded yet.
This page as .md · .json · in your agent: get_signal("CVE-2026-112040")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.