CVE-2026-18721

Executive Summary

CVE-2026-18721 is an open redirect vulnerability (CWE-601) identified in kalcaddle kodbox version 1.67 Build 02, specifically within the /user/sso/apiLogin endpoint of the SSO API Login component. The flaw permits an unauthenticated remote attacker to manipulate the callbackUrl argument, redirecting victims to arbitrary external domains. With a CVSS score of 4.3 (Medium), the vulnerability requires user interaction (social engineering) to achieve impact, but its exploitation is trivial and does not require any authentication or special privileges. As of this report, the vendor has not responded to disclosure attempts, no patch is available, and the vulnerability remains unpatched with public exploit details disclosed.

Technical Analysis

The vulnerability resides in the SSO (Single Sign-On) API login functionality of kodbox, a web-based file management and collaboration platform. Kodbox's SSO integration is designed to authenticate users via external identity providers, and the /user/sso/apiLogin endpoint handles the callback after successful identity verification.

Vulnerability Mechanism:

The endpoint accepts a callbackUrl parameter, which is used to redirect the user's browser back to the application after SSO authentication completes. The application fails to validate that the supplied callbackUrl value points to the same origin (same scheme, host, and port) as the kodbox instance itself. Instead, the value is used directly in an HTTP redirect (e.g., via a Location header or JavaScript-based redirection) without sanitization or allowlist checking.

The vulnerable code path likely resembles:

// /user/sso/apiLogin
$callbackUrl = $_GET['callbackUrl'];
// ... perform SSO token validation ...
header("Location: " . $callbackUrl);
exit();

Because no validation is performed against an internal allowlist of trusted redirect destinations, an attacker can supply callbackUrl=https://evil.example.com and the application will redirect the authenticated (or about-to-be-authenticated) user to the attacker-controlled domain.

Attack Surface:

• Endpoint: /user/sso/apiLogin — accessible remotely via HTTP/HTTPS.
• Authentication: None required to trigger the redirect; however, the SSO context means the endpoint is invoked during the login flow, so the attacker must entice a legitimate user to initiate or complete an SSO login with a crafted URL.
• Attack Vector: Network-based (AV:N), Low complexity (AC:L), Requires user interaction (UI:R).

Related Code-Level Considerations:

Open redirects of this nature are frequently chained with:

1. Credential Phishing: The redirect leads to a look-alike login page that harvests SSO credentials or session tokens.
2. OAuth/SSO Token Theft: If the callbackUrl is used in a POST or included in a state parameter, a malicious redirect could leak authorization codes or tokens in the Referer header.
3. Bypassing SSO flows: An attacker can craft a link that, when clicked, completes a legitimate SSO session and silently sends the victim to a malicious site, eroding trust in the kodbox login flow.

Exploitation Scenarios

The following step-by-step attack chain describes how an attacker would exploit CVE-2026-18721 in a real-world scenario. No public PoC is required; the open redirect is deterministic and trivially triggerable.

Step 1: Reconnaissance & Target Identification

The attacker identifies internet-facing kodbox instances. Kodbox is commonly exposed via ports 80/443 and can be fingerprinted by its login page (/index.php?user/login) or the presence of kodbox in HTTP headers. The attacker uses search engines or mass-scanning tools (e.g., Shodan) to enumerate candidate targets.

Step 2: Crafting the Malicious URL

The attacker constructs a URL targeting the vulnerable endpoint:

https://victim-kodbox.com/index.php/user/sso/apiLogin?callbackUrl=https%3A%2F%2Fattacker-controlled.com%2Fphishing

URL-encoding the callbackUrl value ensures the parameter is parsed correctly. The attacker does not need valid SSO credentials or a valid session — the redirect logic executes regardless of the SSO handshake outcome (unless the endpoint validates the token before the redirect, in which case the attacker uses a pre-existing or aborted SSO flow; in practice many implementations perform redirects before token validation, or the attacker can trigger the endpoint with a valid but transient token obtained from a real SSO provider).

Step 3: Delivery & User Interaction

The attacker distributes the crafted URL via:

• Phishing emails impersonating the IT department, asking users to "re-authenticate" to kodbox.
• Social media messages or malicious QR codes.
• Compromised web pages that contain a link or auto-submit form to the kodbox endpoint.

The victim, a legitimate kodbox user, clicks the link while logged in (or as part of a fresh login flow).

Step 4: Execution & Redirect

The victim's browser makes a GET request to /user/sso/apiLogin?callbackUrl=https://attacker-controlled.com/phishing. The kodbox application processes the request and returns a 302 Found (or JavaScript window.location) response with Location: https://attacker-controlled.com/phishing. The browser follows the redirect.

Step 5: Post-Exploitation Impact

At the attacker-controlled destination, the attacker can:

• Serve a credential phishing page that mimics the kodbox login form. Because the victim arrived via a redirect from the legitimate kodbox domain, they are more likely to trust the page and enter credentials or SSO tokens.
• Capture the Referer header, which may contain a valid SSO state or authorization code if kodbox appends such data to its redirect (e.g., ?code=...).
• If the attacker can combine the open redirect with a session fixation or token leakage vulnerability, they may obtain a valid session token and log in as the victim.

Step 6: Persistence & Escalation

If the attacker obtains valid kodbox credentials, they can log in directly to the instance and potentially escalate to file exfiltration, ransomware deployment, or lateral movement within the internal network where kodbox is hosted.

Impact Assessment

CVSS Analysis (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N — 4.3 Medium):

• Attack Vector: Network (AV:N) — The vulnerability is remotely exploitable over HTTP/HTTPS.
• Attack Complexity: Low (AC:L) — No special conditions or race conditions are required.
• Privileges Required: None (PR:N) — An unauthenticated attacker can craft and trigger the redirect.
• User Interaction: Required (UI:R) — The victim must click the crafted link or interact with the redirect.
• Scope: Unchanged (S:U) — The vulnerability impacts only the victim's browser session, not other systems.
• Confidentiality Impact: None (C:N) — No direct data disclosure to the attacker.
• Integrity Impact: Low (I:L) — The attacker can alter the destination of the redirect, but cannot modify kodbox data.
• Availability Impact: None (A:N) — No denial of service impact.

Business Impact: The primary impact is credential phishing and brand abuse. Because kodbox is an enterprise file management platform, successful phishing yields access to sensitive corporate documents. The open redirect also undermines the security trust placed in the kodbox domain — users clicking a link on kodbox.company.com expect to remain on that domain. This weakness can be exploited in broader phishing campaigns targeting the organization. Additionally, if the attacker combines this with other SSO misconfigurations (e.g., weak token validation in the SSO handshake), they could potentially hijack active sessions, escalating to full account takeover.

Blast Radius:

• Affected Products: kalcaddle kodbox 1.67 Build 02 (all deployments of this exact build are vulnerable; older builds may share the same code path but have not been confirmed).
• Affected Users: All kodbox users who can be socially engineered into clicking a crafted URL.
• Affected Verticals: Any organization using kodbox for internal or customer-facing file sharing; likely SMBs to mid-market enterprises due to kodbox's typical deployment profile.

Threat Actor Likelihood: Given the low complexity and public disclosure of the exploit details, this vulnerability is ripe for inclusion in commodity phishing kits. It is highly likely that attacker groups targeting small-to-medium enterprises will integrate this open redirect into their phishing infrastructure within weeks of adoption.

Detection Guidance

Sigma Rule

title: KODBOX SSO Open Redirect Exploitation Attempt
id: 7d9d3c6a-2f5e-4b8a-9d1c-3a0f54e81b2a
status: experimental
description: Detects HTTP requests to kodbox SSO apiLogin endpoint with suspicious external callbackUrl arguments indicating open redirect exploitation (CVE-2026-18721).
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-18721
tags:
    - attack.initial-access
    - attack.t1566
    - cve.2026.18721
logsource:
    category: webserver
    product: apache
    definition: 'Web server access logs for kodbox instances'
detection:
    selection:
        cs-method: 'GET'
        c-uri|contains|all:
            - '/user/sso/apiLogin'
            - 'callbackUrl='
        c-uri|contains:
            - 'https://'
        c-uri|re: 'callbackUrl=https?://(?!.*victim-domain\.com|.*localhost|.*127\.0\.0\.1)'
    filter_known_domains:
        c-uri|contains:
            - 'callbackUrl=https://kodbox.company.com'
            - 'callbackUrl=https://www.kodbox.company.com'
    condition: selection and not filter_known_domains
level: high
falsepositives:
    - Legitimate SSO callbacks to external identity providers if callbackUrl is used for legitimate federation (requires monitoring tuning).

YARA Rule

rule KODBOX_SSO_OPEN_REDIRECT_CVE_2026_18721
{
    meta:
        author = "ValtersIT Threat Intelligence"
        description = "Detects kodbox source code patterns or HTTP logs indicating open redirect in /user/sso/apiLogin via callbackUrl (CVE-2026-18721)"
        date = "2026-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-18721"
        cve = "CVE-2026-18721"
        severity = "medium"

    strings:
        $s1 = "/user/sso/apiLogin" ascii nocase
        $s2 = "callbackUrl" ascii nocase
        $s3 = "header(\"Location: " ascii nocase
        $s4 = "window.location.href" ascii nocase
        $s5 = "apiLogin" ascii nocase

    condition:
        uint16(0) == 0x5A4D or filesize < 10KB
        and 2 of them
        and ($s1 or $s5)
        and $s2
        and ($s3 or $s4)
}

Suricata IDS Rule

alert http any any -> any any (
    msg:"KODBOX SSO Open Redirect Attempt (CVE-2026-18721)";
    flow:established,to_server;
    http.method; content:"GET";
    http.uri; content:"/user/sso/apiLogin"; nocase;
    http.uri; content:"callbackUrl="; nocase;
    http.uri; pcre:"/callbackUrl=https?:\/\/(?!.*victim\.com)/i";
    sid:202618721001;
    rev:1;
    classtype:web-application-activity;
    reference:cve,2026-18721;
    metadata:created_at 2026_01_01, updated_at 2026_01_01;
)

Note: Replace victim\.com with the specific kodbox domain(s) in your environment. Adjust to detect callback URLs pointing to known malicious domains or any external domain beyond a trusted allowlist.

Elastic Detection

network where process.name == "nginx" or process.name == "apache2" or process.name == "httpd"
  and network.protocol == "http"
  and http.request.method == "GET"
  and url.path in ("/user/sso/apiLogin", "/index.php/user/sso/apiLogin")
  and url.query contains "callbackUrl="
  and not wildcard(url.query, "*callbackUrl=https://*.trusted-domain.com*")
  and not wildcard(url.query, "*callbackUrl=https://localhost*")
  and not wildcard(url.query, "*callbackUrl=https://127.0.0.1*")
  and wildcard(url.query, "*callbackUrl=https://*")

Splunk SPL Query

index=web sourcetype=access_combined
| where like(uri_path, "%/user/sso/apiLogin%")
| rex field=uri_query "callbackUrl=(?<callback_url>[^&]+)"
| eval decoded_callback=urldecode(callback_url)
| where like(decoded_callback, "https://%") 
    AND NOT like(decoded_callback, "https://www.trusted-domain.com%")
    AND NOT like(decoded_callback, "https://kodbox.trusted-domain.com%")
| stats count by src_ip, uri, decoded_callback, status, _time
| sort - _time

Wazuh OSSEC Rule

<group name="web-application,">
    <rule id="980535" level="12">
        <if_sid>31100</if_sid>
        <match>/user/sso/apiLogin</match>
        <regex>callbackUrl=https?:\/\/</regex>
        <description>Potential KODBOX SSO Open Redirect exploitation (CVE-2026-18721) - external callback URL detected</description>
        <mitre>
            <id>T1566</id>
        </mitre>
        <group>attack.initial-access</group>
        <info type="cve">CVE-2026-18721</info>
    </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 0/4 — UNPATCHED

No patch is available. The vendor (kalcaddle) was contacted early about this disclosure but has not responded. There is no evidence of a fix in any tracked version as of this report.

Immediate Mitigations (operate under the assumption the vulnerability is exploitable):

1. Network-Level Block: Deploy a WAF (Web Application Firewall) rule to block or alert on any request to /user/sso/apiLogin where the callbackUrl parameter does not match a strict allowlist of trusted internal domains.
2. Input Validation via Reverse Proxy: Configure nginx/Apache to reject requests where callbackUrl does not start with the kodbox instance's own origin. Example nginx snippet:

   if ($arg_callbackUrl !~* ^https?://example\.com/) {
       return 403;
   }
   

3. Limit SSO Endpoint Exposure: Restrict access to /user/sso/apiLogin to only authorized SSO provider IP addresses via firewall or reverse proxy ACLs.
4. User Awareness: Inform kodbox users to always type the kodbox URL manually and be suspicious of any link that appears to navigate away from the kodbox domain.

Patch/Upgrade Steps:

• Monitor the kalcaddle kodbox GitHub repository and official release notes for version 1.67 Build 03 or later.
• As soon as a patched version (e.g., 1.68 or 1.67 Build 03) is released, upgrade immediately.
• If the vendor remains unresponsive, consider manually patching the vulnerable code by adding origin validation on the callbackUrl parameter in /user/sso/apiLogin.

Long-Term Hardening:

• Adopt an SSO library (e.g., openidconnect-php) that implements native redirect-URI validation against registered client IDs — do not rely on custom callback handling.
• Conduct a full code review of the kodbox authentication and SSO modules for similar unvalidated redirect patterns.
• Enforce MFA for all kodbox accounts to limit the impact of credential phishing.
• Deploy broad HTTP security headers (e.g., Content-Security-Policy: default-src 'self') to reduce the success of injected content.
• Regularly monitor vulnerability feeds and vendor announcements for kodbox.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-18721
2. CWE-601 Open Redirect: https://cwe.mitre.org/data/definitions/601.html
3. KodBox Official Repository (monitor for patches): https://github.com/kalcaddle/KodBox
4. KodBox Official Site: https://kodbox.com/
5. CISA Known Exploited Vulnerabilities Catalog (no entry as of this report): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

Known Threat Actor Campaigns / Exploitation:

As of the drafting date, there is no confirmed in-the-wild exploitation of CVE-2026-18721, and no known threat actor campaigns have been attributed to this vulnerability. The exploit details were publicly disclosed, meaning the attack surface is public and weaponization kits are likely to emerge shortly. EPSS scoring has not been released by FIRST.org. The risk should be treated as elevated due to the ease of exploitation and lack of vendor response.