CVE-2026-42259

Saltcorn: Open Redirect in `POST /auth/login` due to incomplete `is_relative_url` validation (backslash bypass)

MEDIUM

5.1

CVSS Score

Published: May 7, 2026 at 06:54 PM UTC

Updated: June 17, 2026 at 10:47 AM UTC

1 product affected across 1 vendorSaltcorn

Using saltcorn by saltcorn?

Get instant alerts when new vulnerabilities affect saltcorn - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

MEDIUM5.1

Exploit prediction

EPSS 0.3%

SSVC

PoC

Description

Saltcorn is an extensible, open source, no-code database application builder. Prior to versions 1.4.6, 1.5.6, and 1.6.0-beta.5, Saltcorn validates the post-login dest parameter with a string check that only blocks :/ and //. Because all WHATWG-compliant browsers normalise backslashes (\) to forward slashes (/) for special schemes, a payload such as /\evil.com/path slips through is_relative_url(), is emitted unchanged in the HTTP Location header, and causes the browser to navigate cross-origin to an attacker-controlled domain. The bug is reachable on a default install and only requires a victim who can be tricked into logging in via a crafted Saltcorn URL. This issue has been patched in versions 1.4.6, 1.5.6, and 1.6.0-beta.5.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Saltcorn · Saltcorn

60%

v < 1.4.6v < 1.5.6v < 1.6.0-beta.5

Affected range stops below 1.4.6, so it looks safe — our inference, not a vendor statement

Affected range stops below 1.5.6, so it looks safe — our inference, not a vendor statement

Affected range stops below 1.6.0-beta.5, so it looks safe — our inference, not a vendor statement

Remediation

No guide yet

No remediation guidance has been written for this CVE yet, and no fixed version or vendor advisory is recorded against it.

References (1)

x_refsource_CONFIRM

Source: cverecord

https://github.com/saltcorn/saltcorn/security/advisories/GHSA-f3g8-9xv5-77gv

SSVC — Action Prioritization

SSVCPoCNot automatablePartial impact

SSVC signals action urgency (what to patch first), separate from CVSS which measures severity.

CVSS

5.1MEDIUMGitHub_M

Vector?

Quick Info

StatusDEFERRED

CWE

CWE-601

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Create account Sign in

Free plan, no card