PULSE
EN
FEED
ransomeverstake reclama a da*****t.com · Technologyransomeverstake reclama a ra*****g.comransomredact reclama a Holland & Knight · US · Professional Servicesransomqilin reclama a Astino Berhad · MY · Manufacturingransomakira reclama a Princeton Management · Financial Servicesransomakira reclama a Usnextransomakira reclama a Howells Motor Freight · US · Transportationransomsafepay reclama a deom.be · BEransomhyflock reclama a Ateşsan Ambalaj · TR · Manufacturingransompear reclama a Neiman & Company, Inc. · US · Financial Servicesransomn0n reclama a Company #117 · USransomn0n reclama a Company #116 · USransomn0n reclama a Company #115 · USransomn0n reclama a Company #114 · USransomeverstake reclama a da*****t.com · Technologyransomeverstake reclama a ra*****g.comransomredact reclama a Holland & Knight · US · Professional Servicesransomqilin reclama a Astino Berhad · MY · Manufacturingransomakira reclama a Princeton Management · Financial Servicesransomakira reclama a Usnextransomakira reclama a Howells Motor Freight · US · Transportationransomsafepay reclama a deom.be · BEransomhyflock reclama a Ateşsan Ambalaj · TR · Manufacturingransompear reclama a Neiman & Company, Inc. · US · Financial Servicesransomn0n reclama a Company #117 · USransomn0n reclama a Company #116 · USransomn0n reclama a Company #115 · USransomn0n reclama a Company #114 · US
← Todos los CVEs
CVE Watch2 nov 2026

CVE-2024-12141

The product fails to sufficiently validate callback URLs, allowing them to be manipulated with malicious payloads when processed through a w

CVSS

4.3

Medio

EPSS

—

KEV

—

Exploit Today

—

0-100

Publicado: 2 nov 2026 · Última mod.: 2 nov 2026 · CWE-601

EPSS · 30d

Sin historial EPSS suficiente todavía.

Descripción técnica

The product fails to sufficiently validate callback URLs, allowing them to be manipulated with malicious payloads when processed through a weak regular expression or when validation is omitted. An attacker can exploit this by crafting a link that appears legitimate but redirects users to an attacker-controlled page. This redirection facilitates phishing attacks, enabling the harvesting of sensitive user information, potentially leading to unauthorized access or data theft.

Referencias oficiales
CVEs relacionados
CVECVSSEPSSKEVRExplotTítuloVis.
CVE-2024-23725.4 MED
—
——0The affected components accept user-supplied input for constructing redirection URLs without enforcing expected validation constraints. This allows an attacker to provide a crafted URL that can redirect users to an arbitrary external domain. By leveraging this open redirection vulnerability, an attacker can craft a malicious link that, when clicked by a user, redirects them to an attacker-controlled page. This can be used in conjunction with social engineering techniques to execute phishing attacks, aiming to obtain sensitive information or cause other harm.4hCVE-2026-1070207.5 ALT
47.5%
——14An issue in the activity.LoadLinkLaterActivity component of FeedEx / Handy News Reader versionCode 116 allows attackers to force victim users into fetching a crafted URL.4dCVE-2026-1184256.8 MED
13.7%
——4A flaw was found in the secure-redirect-uris-enforcer client policy of Keycloak, an identity and access management solution. The issue occurs when the policy is configured to allow loopback addresses, as Keycloak resolves hostnames via DNS during validation. An attacker can bypass domain allowlist restrictions by using a hostname that resolves to a loopback address, potentially allowing the registration of unauthorized redirect URIs.4dCVE-2026-1186584.7 MED
8.2%
——2Echo is a Go web framework. Prior to 4.15.2 and 5.1.1, Context.Scheme returns values from X-Forwarded-Proto, X-Forwarded-Protocol, or X-Url-Scheme without validating that they are supported web schemes. WWWRedirect and NonWWWRedirect use that value to construct a Location header, so an attacker controlling a forwarded scheme header can cause a redirect to use an arbitrary URI scheme. Exploitation requires an affected redirect middleware and user interaction with the response; the HTTPS-specific redirect variants hardcode HTTPS and are unaffected. This issue is fixed in 4.15.2 and 5.1.1.4dCVE-2026-1186566.1 MED
9.4%
——3Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, sanitizeURI checks only the first two bytes of a redirect target before deciding whether it begins with an absolute-path separator pair. When AddTrailingSlash or RemoveTrailingSlash is configured with a redirect status, a slash, TAB, separator path form can evade the guard, be emitted in the Location header, and be normalized by a browser into an attacker-controlled host. This issue is fixed in 4.16.0 and 5.4.0.4dCVE-2026-1110314.7 MED
15.2%
——5The Welcart e-Commerce WordPress plugin before 2.12.6 does not validate a user-supplied URL before using it in a redirect, allowing unauthenticated attackers to redirect users to arbitrary external websites.5d