---
id: "CVE-2026-128637"
page: "https://infrastack.ai/live/CVE-2026-128637"
kind: "vulnerability"
aliases: ["CVE-2026-128637"]
title: "MISP Modules: login redirect lets attackers send users to phishing sites"
severity: "medium"
cvss: 5.1
epss: null
exploited: false
status: "open"
category: "other"
products: [{"name": "misp-modules", "fixed": [], "affected": "", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["misp-modules", "other", "self-hosted", "threat-intel"]
not_affected_if: ["website-component-not-deployed"]
published_at: "2026-11-13T08:17:17+00:00"
first_seen_at: "2026-11-13T08:44:24+00:00"
updated_at: "2026-11-13T08:45:34+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-128637", "first_seen_at": "2026-11-13T08:44:24+00:00"}]
exploit_sources: []
---

# MISP Modules: login redirect lets attackers send users to phishing sites

Link for people: https://infrastack.ai/live/CVE-2026-128637 (this .md is for agents)

The MISP Modules website's /login route passes a user-supplied next parameter straight into a redirect after sign-in. An attacker can send a crafted login link so that a victim lands on an attacker-controlled page after authenticating, where credentials or other data can be phished.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:misp-modules affected range not listed fixed no fixed version listed

## How to check

- Check whether the misp-modules website component is deployed, looking for website/app/account/account.py.
- Review the /login handler in website/app/account/account.py for use of the next parameter passed to redirect() without validation.
- Confirm the installed misp-modules version against the patch linked from the sources; the sources give no version boundaries.

## Fix

- A patch is linked from the sources; the sources name no fixed version.

## Timeline

- 2026-11-13T08:44:24+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-128637

## Documents

- [fix] Patch: github.com https://github.com/MISP/misp-modules/commit/d115f00414e761b0b70c8c8671edac681de74a4c

## From the sources

The MISP Modules website component contains an open redirect vulnerability in its login endpoint. The /login route accepted a user-supplied next query parameter and passed it directly to Flask's redirect() function without validating the destination. An attacker could craft a URL such as https://victim-host/login?next=https://attacker.example/phish and deliver it to a user (e.g., via email or a lookalike page). After the user successfully authenticated, the application issued a 302 redirect to the attacker-controlled external URL. This enables phishing attacks where a user, believing they are still on the legitimate MISP Modules site, may enter additional credentials or sensitive information on the attacker's page. It can also be used to obscure the true destination of a link, bypassing user trust in the legitimate domain. The vulnerability requires the victim to interact with the crafted URL and complete a login, but no prior authentication or special configuration is needed on the attacker's side. The affected component is the website sub-project of misp-modules, specifically the account blueprint in website/app/account/account.py. No version boundaries are specified in the patch metadata.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_