{"id":"CVE-2026-112040","kind":"vulnerability","aliases":["CVE-2026-112040"],"related":[],"title":"diem: sign-in Referer parameter enables open redirect attacks","description":"A vulnerability was determined in diem-project diem up to 116974edfb9a5b8bd69cb13586dc62bcdbb485ad. This affects an unknown part of the file dmCorePlugin/plugins/dmUserPlugin/modules/dmUser/lib/BasedmUserActions.class.php of the component Sign-In. This manipulation of the argument Referer causes open redirect. The attack is possible to be carried out remotely. The exploit has been publicly disclosed and may be utilized. This product adopts a rolling release strategy to maintain continuous delivery. Therefore, version details for affected or updated releases cannot be specified. The project was informed of the problem early through an issue report but has not responded yet.","summary":"The diem PHP project's sign-in module does not validate the Referer argument, so a crafted link can send a user to an attacker-chosen site after login. An attacker can use this to build convincing phishing links that appear to come from the legitimate application.","severity":"medium","cvss":5.0,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["diem","package","php","self-hosted"],"not_affected_if":["diem-not-deployed"],"how_to_check":"- Check whether the deployment runs diem from the `dmCorePlugin/plugins/dmUserPlugin` code (unknown version range; the sources say versions cannot be specified)\n- Review `dmCorePlugin/plugins/dmUserPlugin/modules/dmUser/lib/BasedmUserActions.class.php` for unvalidated use of the Referer value\n- Test whether a sign-in request with an external `Referer` value redirects off-site","fix":null,"status":"open","published_at":"2026-10-19T02:17:06+00:00","first_seen_at":"2026-10-23T21:57:17+00:00","triaged_at":"2026-10-25T04:30:50+00:00","updated_at":"2026-10-25T04:30:50+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T04:30:50Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"diem: sign-in Referer parameter enables open redirect attacks","impact":"low","summary":"The diem PHP project's sign-in module does not validate the Referer argument, so a crafted link can send a user to an attacker-chosen site after login. An attacker can use this to build convincing phishing links that appear to come from the legitimate application.","category":"package","nicknames":[],"who_cares":["diem","php","self-hosted"],"confidence":0.6,"needs_auth":"no","worst_case":"users are redirected to attacker-controlled phishing sites after sign-in","analyst_note":"Confirm whether a patched release or commit exists after 116974edfb9a5b8bd69cb13586dc62bcdbb485ad and whether the disclosure has a public exploit reference; the sources only cite NVD.","how_to_check":"- Check whether the deployment runs diem from the `dmCorePlugin/plugins/dmUserPlugin` code (unknown version range; the sources say versions cannot be specified)\n- Review `dmCorePlugin/plugins/dmUserPlugin/modules/dmUser/lib/BasedmUserActions.class.php` for unvalidated use of the Referer value\n- Test whether a sign-in request with an external `Referer` value redirects off-site","needs_analyst":true,"not_affected_if":["diem-not-deployed"],"who_is_affected":"Teams running the diem-project diem application with the dmUser sign-in plugin exposed to users on the internet. The sources say the project has not responded and no fixed release is named, so mitigation likely requires a local code change or a redirect allowlist. Teams not running diem can skip it.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000654,"input_tokens":3463,"output_tokens":616,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-112040':13A,16A '-2026':12A,15A '116974edfb9a5b8bd69cb13586dc62bcdbb485ad':83C 'adopt':129C 'affect':85C,142C 'appear':65B 'applic':71B 'argument':37B,103C 'attack':10A,49B,55B,109C 'attacker-chosen':48B 'build':60B 'cannot':146C 'carri':114C 'caus':105C 'chosen':50B 'come':67B 'compon':95C 'continu':136C 'convinc':61B 'craft':40B 'cve':11A,14A 'deliveri':137C 'detail':140C 'determin':75C 'diem':1A,17B,24B,78C,80C 'diem-project':77C 'disclos':122C 'dmcoreplugin/plugins/dmuserplugin/modules/dmuser/lib/basedmuseractions.class.php':92C 'earli':156C 'enabl':7A 'exploit':118C 'file':91C 'host':22B 'inform':152C 'issu':159C 'legitim':70B 'link':41B,63B 'login':53B 'maintain':135C 'manipul':100C 'may':124C 'modul':31B 'open':8A,106C 'packag':18B 'paramet':6A 'part':88C 'phish':62B 'php':19B,25B 'possibl':111C 'problem':155C 'product':128C 'project':26B,79C,150C 'public':121C 'redirect':9A,107C 'refer':5A,36B,104C 'releas':132C,145C 'remot':116C 'report':160C 'respond':164C 'roll':131C 'self':21B 'self-host':20B 'send':43B 'sign':3A,29B,97C 'sign-in':2A,28B,96C 'site':51B 'specifi':148C 'strategi':133C 'therefor':138C 'unknown':87C 'updat':144C 'use':57B 'user':45B 'util':126C 'valid':34B 'version':139C 'vulner':73C 'yet':165C","nicknames":[],"mitigations":[],"who_affected":"Teams running the diem-project diem application with the dmUser sign-in plugin exposed to users on the internet. The sources say the project has not responded and no fixed release is named, so mitigation likely requires a local code change or a redirect allowlist. Teams not running diem can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-19T02:17:06+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-112040","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112040","severity":null,"published_at":"2026-10-19T02:17:06+00:00","modified_at":"2026-10-19T17:17:09+00:00","first_seen_at":"2026-10-23T21:57:17+00:00","fetched_at":"2026-10-23T22:28:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}