---
id: "CVE-2026-112040"
kind: "vulnerability"
aliases: ["CVE-2026-112040"]
title: "diem: sign-in Referer parameter enables open redirect attacks"
severity: "medium"
cvss: 5.0
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["diem", "package", "php", "self-hosted"]
not_affected_if: ["diem-not-deployed"]
published_at: "2026-10-19T02:17:06+00:00"
first_seen_at: "2026-10-23T21:57:17+00:00"
updated_at: "2026-10-25T04:30:50+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-112040", "first_seen_at": "2026-10-23T21:57:17+00:00"}]
---

# diem: sign-in Referer parameter enables open redirect attacks

The diem PHP project's sign-in module does not validate the Referer argument, so a crafted link can send a user to an attacker-chosen site after login. An attacker can use this to build convincing phishing links that appear to come from the legitimate application.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check whether the deployment runs diem from the `dmCorePlugin/plugins/dmUserPlugin` code (unknown version range; the sources say versions cannot be specified)
- Review `dmCorePlugin/plugins/dmUserPlugin/modules/dmUser/lib/BasedmUserActions.class.php` for unvalidated use of the Referer value
- Test whether a sign-in request with an external `Referer` value redirects off-site

## Timeline

- 2026-10-23T21:57:17+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-112040

## From the sources

A vulnerability was determined in diem-project diem up to 116974edfb9a5b8bd69cb13586dc62bcdbb485ad. This affects an unknown part of the file dmCorePlugin/plugins/dmUserPlugin/modules/dmUser/lib/BasedmUserActions.class.php of the component Sign-In. This manipulation of the argument Referer causes open redirect. The attack is possible to be carried out remotely. The exploit has been publicly disclosed and may be utilized. This product adopts a rolling release strategy to maintain continuous delivery. Therefore, version details for affected or updated releases cannot be specified. The project was informed of the problem early through an issue report but has not responded yet.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_