{"id":"CVE-2026-120327","kind":"vulnerability","aliases":["CVE-2026-120327"],"related":[],"title":"Click tracking middleware redirects users to arbitrary external URLs","description":"The click tracking middleware accepts an arbitrary target URL and redirects to it. Attackers can misuse links to the website to redirect users to external sites.","summary":"The click tracking middleware accepts any target URL and redirects visitors to it. An attacker can craft links on the site that send users to external malicious sites.","severity":"medium","cvss":5.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["open-redirect","other","web-app"],"not_affected_if":["no-click-tracking-middleware"],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-03T10:17:17+00:00","first_seen_at":"2026-11-03T10:20:15+00:00","triaged_at":"2026-11-03T10:20:40+00:00","updated_at":"2026-11-03T10:20:40+00:00","category":"other","confidence":0.4,"triage":{"at":"2026-11-03T10:20:40Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Click tracking middleware redirects users to arbitrary external URLs","impact":"low","summary":"The click tracking middleware accepts any target URL and redirects visitors to it. An attacker can craft links on the site that send users to external malicious sites.","audience":"businesses","category":"other","nicknames":[],"who_cares":["web-app","open-redirect"],"confidence":0.4,"fix_status":"unknown","needs_auth":"no","worst_case":"Users are redirected to attacker-chosen external sites for phishing.","analyst_note":"Identify the affected product and versions from the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-120327 and confirm the fix.","how_to_check":"unknown","plain_action":"","needs_analyst":true,"not_affected_if":["no-click-tracking-middleware"],"who_is_affected":"Sites that run the affected click tracking middleware and expose its redirect path to visitors. The sources do not name the product or version, so exposure cannot be confirmed from them.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000612,"input_tokens":4063,"output_tokens":411,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-120327':12A,15A '-2026':11A,14A 'accept':27B,55C 'app':22B 'arbitrari':7A,57C 'attack':37B,64C 'click':1A,24B,52C 'craft':39B 'cve':10A,13A 'extern':8A,48B,75C 'link':40B,67C 'malici':49B 'middlewar':3A,26B,54C 'misus':66C 'open':17B 'open-redirect':16B 'redirect':4A,18B,32B,61C,72C 'send':45B 'site':43B,50B,76C 'target':29B,58C 'track':2A,25B,53C 'url':9A,30B,59C 'user':5A,46B,73C 'visitor':33B 'web':21B 'web-app':20B 'websit':70C","nicknames":[],"mitigations":[],"who_affected":"Sites that run the affected click tracking middleware and expose its redirect path to visitors. The sources do not name the product or version, so exposure cannot be confirmed from them.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["medium","openredirect","other","webapp"],"first_public_at":"2026-11-03T10:17:17+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"f4fb688c-4412-4426-b4b8-421ecf27b14a","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-120327","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120327","severity":null,"published_at":"2026-11-03T10:17:17+00:00","modified_at":"2026-11-03T10:17:17+00:00","first_seen_at":"2026-11-03T10:20:15+00:00","fetched_at":"2026-11-03T10:20:15+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}