{"id":"CVE-2026-128637","kind":"vulnerability","aliases":["CVE-2026-128637"],"related":[],"title":"MISP Modules: login redirect lets attackers send users to phishing sites","description":"The MISP Modules website component contains an open redirect vulnerability in its login endpoint. The /login route accepted a user-supplied next query parameter and passed it directly to Flask's redirect() function without validating the destination. An attacker could craft a URL such as https://victim-host/login?next=https://attacker.example/phish and deliver it to a user (e.g., via email or a lookalike page). After the user successfully authenticated, the application issued a 302 redirect to the attacker-controlled external URL. This enables phishing attacks where a user, believing they are still on the legitimate MISP Modules site, may enter additional credentials or sensitive information on the attacker's page. It can also be used to obscure the true destination of a link, bypassing user trust in the legitimate domain. The vulnerability requires the victim to interact with the crafted URL and complete a login, but no prior authentication or special configuration is needed on the attacker's side. The affected component is the website sub-project of misp-modules, specifically the account blueprint in website/app/account/account.py. No version boundaries are specified in the patch metadata.","summary":"The MISP Modules website's /login route passes a user-supplied next parameter straight into a redirect after sign-in. An attacker can send a crafted login link so that a victim lands on an attacker-controlled page after authenticating, where credentials or other data can be phished.","severity":"medium","cvss":5.1,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"misp-modules","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["misp-modules","other","self-hosted","threat-intel"],"not_affected_if":["website-component-not-deployed"],"how_to_check":"- Check whether the misp-modules website component is deployed, looking for website/app/account/account.py.\n- Review the /login handler in website/app/account/account.py for use of the next parameter passed to redirect() without validation.\n- Confirm the installed misp-modules version against the patch linked from the sources; the sources give no version boundaries.","fix":"- A patch is linked from the sources; the sources name no fixed version.","status":"open","published_at":"2026-11-13T08:17:17+00:00","first_seen_at":"2026-11-13T08:44:24+00:00","triaged_at":"2026-11-13T08:45:34+00:00","updated_at":"2026-11-13T08:45:34+00:00","category":"other","confidence":0.7,"triage":{"at":"2026-11-13T08:45:34Z","model":"claude-haiku-5-5","output":{"fix":"- A patch is linked from the sources; the sources name no fixed version.","reach":"internet","title":"MISP Modules: login redirect lets attackers send users to phishing sites","impact":"medium","summary":"The MISP Modules website's /login route passes a user-supplied next parameter straight into a redirect after sign-in. An attacker can send a crafted login link so that a victim lands on an attacker-controlled page after authenticating, where credentials or other data can be phished.","audience":"businesses","category":"other","nicknames":[],"who_cares":["misp-modules","self-hosted","threat-intel"],"confidence":0.7,"fix_status":"available","needs_auth":"no","worst_case":"Users are redirected to attacker pages after login and may enter credentials","analyst_note":"","how_to_check":"- Check whether the misp-modules website component is deployed, looking for website/app/account/account.py.\n- Review the /login handler in website/app/account/account.py for use of the next parameter passed to redirect() without validation.\n- Confirm the installed misp-modules version against the patch linked from the sources; the sources give no version boundaries.","plain_action":"","product_name":"misp-modules","needs_analyst":false,"not_affected_if":["website-component-not-deployed"],"who_is_affected":"Teams that run the MISP Modules website component, the web interface of misp-modules, are exposed when users log in through the /login route. The sources describe the flaw in the account blueprint in website/app/account/account.py. Deployments that do not run the website component are not described as affected.","user_interaction":"yes","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.001146,"input_tokens":4807,"output_tokens":1330,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-128637':14A,17A '-2026':13A,16A '/login':36B,97C,131C '/phish':135C '302':158C 'accept':99C 'account':260C 'addit':186C 'affect':246C 'also':198C 'applic':155C 'attack':6A,54B,69B,121C,163C,170C,193C,242C 'attacker-control':68B,162C 'attacker.example':134C 'attacker.example/phish':133C 'authent':73B,153C,234C 'believ':174C 'blueprint':261C 'boundari':266C 'bypass':209C 'complet':228C 'compon':86C,247C 'configur':237C 'contain':87C 'control':70B,164C 'could':122C 'craft':58B,123C,225C 'credenti':75B,187C 'cve':12A,15A 'data':78B 'deliv':137C 'destin':119C,205C 'direct':110C 'domain':215C 'e.g':142C 'email':144C 'enabl':168C 'endpoint':95C 'enter':185C 'extern':165C 'flask':112C 'function':115C 'host':27B,130C 'inform':190C 'intel':30B 'interact':222C 'issu':156C 'land':65B 'legitim':180C,214C 'let':5A 'link':60B,208C 'login':3A,59B,94C,230C 'lookalik':147C 'may':184C 'metadata':272C 'misp':1A,19A,22B,32B,83C,181C,256C 'misp-modul':21B,255C 'misp-modules':18A 'modul':2A,23B,33B,84C,182C,257C 'modules':20A 'need':239C 'next':43B,104C,132C 'obscur':202C 'open':89C 'page':71B,148C,195C 'paramet':44B,106C 'pass':38B,108C 'patch':271C 'phish':10A,81B,169C 'prior':233C 'project':253C 'queri':105C 'redirect':4A,48B,90C,114C,159C 'requir':218C 'rout':37B,98C 'self':26B 'self-host':25B 'send':7A,56B 'sensit':189C 'side':244C 'sign':51B 'sign-in':50B 'site':11A,183C 'special':236C 'specif':258C 'specifi':268C 'still':177C 'straight':45B 'sub':252C 'sub-project':251C 'success':152C 'suppli':42B,103C 'threat':29B 'threat-intel':28B 'true':204C 'trust':211C 'url':125C,166C,226C 'use':200C 'user':8A,41B,102C,141C,151C,173C,210C 'user-suppli':40B,101C 'valid':117C 'version':265C 'via':143C 'victim':64B,129C,220C 'victim-host':128C 'vulner':91C,217C 'websit':34B,85C,250C 'website/app/account/account.py':263C 'without':116C","nicknames":[],"mitigations":[],"who_affected":"Teams that run the MISP Modules website component, the web interface of misp-modules, are exposed when users log in through the /login route. The sources describe the flaw in the account blueprint in website/app/account/account.py. Deployments that do not run the website component are not described as affected.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["mispmodules"],"ptokens":["misp","modules"],"labels":["medium","mispmodules","other","selfhosted","threatintel","vendor"],"campaign_type":null,"search_a":"'-128637':14A,17A '-2026':13A,16A 'attack':6A 'cve':12A,15A 'let':5A 'login':3A 'misp':1A,19A 'misp-modules':18A 'modul':2A 'modules':20A 'phish':10A 'redirect':4A 'send':7A 'site':11A 'user':8A","search_b":"'/login':36B 'attack':54B,69B 'attacker-control':68B 'authent':73B 'control':70B 'craft':58B 'credenti':75B 'data':78B 'host':27B 'intel':30B 'land':65B 'link':60B 'login':59B 'misp':22B,32B 'misp-modul':21B 'modul':23B,33B 'next':43B 'page':71B 'paramet':44B 'pass':38B 'phish':81B 'redirect':48B 'rout':37B 'self':26B 'self-host':25B 'send':56B 'sign':51B 'sign-in':50B 'straight':45B 'suppli':42B 'threat':29B 'threat-intel':28B 'user':41B 'user-suppli':40B 'victim':64B 'websit':34B","search_c":"'/login':97C,131C '/phish':135C '302':158C 'accept':99C 'account':260C 'addit':186C 'affect':246C 'also':198C 'applic':155C 'attack':121C,163C,170C,193C,242C 'attacker-control':162C 'attacker.example':134C 'attacker.example/phish':133C 'authent':153C,234C 'believ':174C 'blueprint':261C 'boundari':266C 'bypass':209C 'complet':228C 'compon':86C,247C 'configur':237C 'contain':87C 'control':164C 'could':122C 'craft':123C,225C 'credenti':187C 'deliv':137C 'destin':119C,205C 'direct':110C 'domain':215C 'e.g':142C 'email':144C 'enabl':168C 'endpoint':95C 'enter':185C 'extern':165C 'flask':112C 'function':115C 'host':130C 'inform':190C 'interact':222C 'issu':156C 'legitim':180C,214C 'link':208C 'login':94C,230C 'lookalik':147C 'may':184C 'metadata':272C 'misp':83C,181C,256C 'misp-modul':255C 'modul':84C,182C,257C 'need':239C 'next':104C,132C 'obscur':202C 'open':89C 'page':148C,195C 'paramet':106C 'pass':108C 'patch':271C 'phish':169C 'prior':233C 'project':253C 'queri':105C 'redirect':90C,114C,159C 'requir':218C 'rout':98C 'sensit':189C 'side':244C 'site':183C 'special':236C 'specif':258C 'specifi':268C 'still':177C 'sub':252C 'sub-project':251C 'success':152C 'suppli':103C 'true':204C 'trust':211C 'url':125C,166C,226C 'use':200C 'user':102C,141C,151C,173C,210C 'user-suppli':101C 'valid':117C 'version':265C 'via':143C 'victim':129C,220C 'victim-host':128C 'vulner':91C,217C 'websit':85C,250C 'website/app/account/account.py':263C 'without':116C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-13T08:17:17+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"5a6e4751-2f3f-4070-9419-94fb35b644e8","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-128637","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-128637","severity":null,"published_at":"2026-11-13T08:17:17+00:00","modified_at":"2026-11-13T08:17:17+00:00","first_seen_at":"2026-11-13T08:44:24+00:00","fetched_at":"2026-11-13T08:44:24+00:00","note":null}],"documents":[{"id":144149,"url":"https://github.com/MISP/misp-modules/commit/d115f00414e761b0b70c8c8671edac681de74a4c","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}