{"id":"CVE-2026-81509","kind":"vulnerability","aliases":["CVE-2026-81509"],"related":[],"title":"nforwardauth: login redirect parameter lets attackers send victims to external sites","description":"nforwardauth is a forward auth service that allows the use of a single authentication middleware for multiple sites. Versions prior to 1.5.1 accept an unvalidated `r` query parameter on the `/login` endpoint and use them as the post-authentication redirect destination. An unauthenticated attacker can create a legitimate `nforwardauth` login URL that redirects a victim to an attacker-controlled website after the victim successfully authenticates. This issue may facilitate phishing and other social-engineering attacks by abusing the trust associated with the legitimate authentication domain. This vulnerability does not provide an unauthenticated ForwardAuth bypass. Version 1.5.1 contains a patch.","summary":"nforwardauth, a forward auth service, takes an unvalidated r query parameter on /login and redirects to it after login. An attacker can craft a real login link that sends a victim to an attacker-controlled site, enabling phishing that abuses the trusted auth domain.","severity":"medium","cvss":6.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["auth","nforwardauth","package","reverse-proxy","self-hosted"],"not_affected_if":["version-1.5.1-or-later"],"how_to_check":"- Check the installed nforwardauth version, for example `nforwardauth --version` or the image tag, and see if it is below `1.5.1`\n- Search your reverse proxy or service config for the /login route to confirm nforwardauth is deployed","fix":"- Upgrade nforwardauth to `1.5.1` or later, which contains the patch","status":"open","published_at":"2026-10-26T18:18:46+00:00","first_seen_at":"2026-10-26T18:31:44+00:00","triaged_at":"2026-10-26T18:34:07+00:00","updated_at":"2026-10-26T18:34:07+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-26T18:34:07Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade nforwardauth to `1.5.1` or later, which contains the patch","reach":"internet","title":"nforwardauth: login redirect parameter lets attackers send victims to external sites","impact":"low","summary":"nforwardauth, a forward auth service, takes an unvalidated r query parameter on /login and redirects to it after login. An attacker can craft a real login link that sends a victim to an attacker-controlled site, enabling phishing that abuses the trusted auth domain.","category":"package","nicknames":[],"who_cares":["nforwardauth","self-hosted","reverse-proxy","auth"],"confidence":0.7,"needs_auth":"no","worst_case":"victims are redirected to attacker sites after logging in","analyst_note":"","how_to_check":"- Check the installed nforwardauth version, for example `nforwardauth --version` or the image tag, and see if it is below `1.5.1`\n- Search your reverse proxy or service config for the /login route to confirm nforwardauth is deployed","needs_analyst":false,"not_affected_if":["version-1.5.1-or-later"],"who_is_affected":"Teams running nforwardauth below version 1.5.1 as a forward auth middleware in front of their sites. The flaw is in the login redirect only and does not bypass ForwardAuth, so exposure is mainly phishing risk for users of those sites.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.0006,"input_tokens":3443,"output_tokens":511,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-81509':14A,17A '/login':39B,102C '1.5.1':93C,170C 'abus':67B,151C 'accept':94C 'allow':79C 'associ':154C 'attack':6A,47B,61B,116C,131C,149C 'attacker-control':60B,130C 'auth':18B,30B,70B,76C 'authent':85C,111C,138C,158C 'bypass':168C 'contain':171C 'control':62B,132C 'craft':49B 'creat':118C 'cve':12A,15A 'destin':113C 'domain':71B,159C 'enabl':64B 'endpoint':103C 'engin':148C 'extern':10A 'facilit':142C 'forward':29B,75C 'forwardauth':167C 'host':26B 'issu':140C 'legitim':120C,157C 'let':5A 'link':53B 'login':2A,45B,52B,122C 'may':141C 'middlewar':86C 'multipl':88C 'nforwardauth':1A,19B,27B,72C,121C 'packag':20B 'paramet':4A,37B,99C 'patch':173C 'phish':65B,143C 'post':110C 'post-authent':109C 'prior':91C 'provid':164C 'proxi':23B 'queri':36B,98C 'r':35B,97C 'real':51B 'redirect':3A,41B,112C,125C 'revers':22B 'reverse-proxi':21B 'self':25B 'self-host':24B 'send':7A,55B 'servic':31B,77C 'singl':84C 'site':11A,63B,89C 'social':147C 'social-engin':146C 'success':137C 'take':32B 'trust':69B,153C 'unauthent':115C,166C 'unvalid':34B,96C 'url':123C 'use':81C,105C 'version':90C,169C 'victim':8A,57B,127C,136C 'vulner':161C 'websit':133C","nicknames":[],"mitigations":[],"who_affected":"Teams running nforwardauth below version 1.5.1 as a forward auth middleware in front of their sites. The flaw is in the login redirect only and does not bypass ForwardAuth, so exposure is mainly phishing risk for users of those sites.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-26T18:18:46+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-81509","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-81509","severity":null,"published_at":"2026-10-26T18:18:46+00:00","modified_at":"2026-10-26T18:18:46+00:00","first_seen_at":"2026-10-26T18:31:44+00:00","fetched_at":"2026-10-26T18:31:44+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}