---
id: "CVE-2026-120327"
kind: "vulnerability"
aliases: ["CVE-2026-120327"]
title: "Click tracking middleware redirects users to arbitrary external URLs"
severity: "medium"
cvss: 5.3
epss: null
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["open-redirect", "other", "web-app"]
not_affected_if: ["no-click-tracking-middleware"]
published_at: "2026-11-03T10:17:17+00:00"
first_seen_at: "2026-11-03T10:20:15+00:00"
updated_at: "2026-11-03T10:20:40+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-120327", "first_seen_at": "2026-11-03T10:20:15+00:00"}]
---

# Click tracking middleware redirects users to arbitrary external URLs

The click tracking middleware accepts any target URL and redirects visitors to it. An attacker can craft links on the site that send users to external malicious sites.

_Summary, check and fix written by a model from the sources; labelled as such._

## Timeline

- 2026-11-03T10:20:15+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-120327

## From the sources

The click tracking middleware accepts an arbitrary target URL and redirects to it. Attackers can misuse links to the website to redirect users to external sites.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_