CVE-2026-66414

Executive Summary

CVE-2026-66414 describes an open redirect vulnerability in Leantime 3.6.2, a popular open‑source project management tool. The flaw resides in the Login controller, where the redirectUrl POST parameter is insufficiently sanitized. An unauthenticated attacker can craft a malicious login URL with a tampered redirectUrl value that bypasses PHP’s FILTER_SANITIZE_URL validation, allowing redirection of authenticated users to arbitrary external sites. This enables phishing attacks, credential theft, and reputational damage. The vulnerability has a CVSS score of 0.0 as per the initial NVD entry, but based on the impact, a reasonable estimation would be CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N (Score 4.3, Medium). No public exploit code is available, but the attack vector is easily reproducible.

Affected Component: Leantime’s Login controller
Attack Vector: Remote, unauthenticated
User Interaction: Required (victim must click a crafted link and log in)
Impact: Phishing, credential theft

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (AV:N) – exploitable remotely
• Attack Complexity (AC): Low (AC:L) – no special conditions
• Privileges Required (PR): None (PR:N) – unauthenticated
• User Interaction (UI): Required (UI:R) – victim must click link and submit login
• Scope (S): Unchanged (S:U) – redirect stays within same security authority
• Confidentiality Impact (C): None (C:N) – direct data breach not applicable
• Integrity Impact (I): Low (I:L) – modifies redirect destination
• Availability Impact (A): None (A:N)

Estimated CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Estimated Score: 4.3 (Medium)

Deep Dive & Mechanics

The vulnerability exists in Leantime’s Login.php controller (or equivalent handling the POST request). Upon login, the application expects a redirectUrl parameter to return the user to the page they were previously on. The code uses FILTER_SANITIZE_URL to clean the input, but this filter is insufficient to block malicious redirects. It only removes invalid characters but does not validate the URL’s host against a whitelist of allowed domains.

An attacker can craft a link like:

https://vulnerable-leantime.com/login?redirectUrl=https://evil.com/steal.php

When a victim visits this URL and logs in successfully, the application redirects the browser to the attacker‑controlled domain. The sanitization filter may allow https://evil.com/steal.php because it contains a valid URL scheme and valid characters. The vulnerability is amplified when the application does not enforce a local redirect or validate the Host header.

Vulnerable vs. Patched Code

Vulnerable code (Leantime 3.6.2):

// Login.php (concept)
$redirectUrl = filter_input(INPUT_POST, 'redirectUrl', FILTER_SANITIZE_URL);
if ($redirectUrl && $this->auth->login($user, $pass)) {
    header('Location: ' . $redirectUrl);
    exit;
}

Patched code (expected fix):

$redirectUrl = filter_input(INPUT_POST, 'redirectUrl', FILTER_SANITIZE_URL);
$parsed = parse_url($redirectUrl);
// Only allow relative paths or same host
if ($redirectUrl && $this->auth->login($user, $pass)) {
    if (empty($parsed['host']) || $parsed['host'] === $_SERVER['HTTP_HOST']) {
        header('Location: ' . $redirectUrl);
        exit;
    } else {
        header('Location: /'); // default safe redirect
        exit;
    }
}

The patch must validate that the redirect URL either has no host (relative path) or matches the application’s own host. Additional hardening includes using a whitelist of allowed domains or implementing a signed token.

Exploitation & Lab Setup

Red Team

Objective: Steal authentication tokens or credentials by tricking a user into visiting a malicious link.

Prerequisites:

• A running instance of Leantime 3.6.2 (can be set up via Docker or manual install)
• An attacker‑controlled web server to capture credentials (e.g., evil.com)

Exploit Steps:

1. Set up a fake login page on the attacker’s server that simulates the Leantime interface (or simply capture the X‑Leantime‑Token or session cookie).
2. Craft the malicious URL:

   https://target-leantime.com/login?redirectUrl=https://evil.com/capture
   

3. Send the link to a victim (e.g., via phishing email) with social engineering pretext (e.g., “Your session expired, please log in again”).
4. Victim clicks the link, sees the legitimate Leantime login page, and enters credentials.
5. Upon successful login, the browser immediately redirects to https://evil.com/capture. The attacker’s server logs the incoming request, which includes the Referer header (if not stripped) and any tokens passed via URL fragment (not likely). However, if the redirect is executed via HTTP 302, the browser sends no credentials directly, but the attacker can host a page that mimics the Leantime dashboard to harvest session cookies when the victim’s browser makes subsequent requests.
6. Alternatively, the attacker can use the redirect to deliver a payload (e.g., via open redirect chaining with another XSS).

Proof of Concept (PoC) using cURL (simulating a user):

curl -X POST "http://target-leantime.com/login" \
  -d "username=test&password=test&redirectUrl=http://evil.com/pwned" \
  -v 2>&1 | grep -i "Location:"

If the response contains a Location header pointing to evil.com, the vulnerability is confirmed.

Blue Team

Detection Strategies:

• Monitor login POST requests for suspicious redirectUrl parameters containing external domains (not the application’s own).
• Log all redirect actions and alert on outbound redirects to unknown destinations.
• Deploy Web Application Firewall (WAF) rules to block redirectUrl values that are not relative or not in a whitelist.

Lab Setup for Blue Team:

• Deploy a honeypot Leantime instance with logging enabled.
• Create alerts based on the Sigma rule provided in Detection Engineering.
• Regularly scan logs for Location: headers pointing to non‑corporate domains.

Indicators of Compromise (IOCs)

• URL pattern: Log entries showing redirectUrl parameter with external FQDN, e.g., /login?redirectUrl=http[s]://[^/]+
• HTTP Response Header: Location: http://evil.com/pwned in server responses to POST /login
• Cookies/Token Exfiltration: Subsequent GET requests from the same IP to attacker‑controlled hosts after login
• Referer Header: Requests from Leantime’s domain to evil.com with Referer pointing to the login page
• Log Entries: Application logs containing the string redirectUrl followed by an external URL

Detection Engineering

YARA Rule

rule Leantime_Open_Redirect_Logs
{
    meta:
        description = "Detect log entries containing open redirect attempts against Leantime"
        author = "Valters IT"
        date = "2025-04-16"
        reference = "CVE-2026-66414"
        severity = "medium"
    strings:
        $redirect_param = /redirectUrl=\x22?https?:\/\/[^\x22&\s]+\.[a-zA-Z]{2,}/
        $login_path = /POST \/login/
    condition:
        $login_path and $redirect_param
}

Sigma Rule

title: Leantime Open Redirect via redirectUrl
id: 037b0b2a-1234-4e56-7890-abcdef123456
status: experimental
description: Detects login requests containing a redirectUrl parameter pointing to an external domain in Leantime.
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-66414
tags:
    - attack.t1190
    - cve.2026.66414
logsource:
    category: application
    product: leantime
detection:
    selection:
        http_method: POST
        url_path: '/login'
        parameters:
            redirectUrl:
                - 'https://*'
                - 'http://*'
    filter:
        parameters:
            redirectUrl|startswith:
                - '/'       # relative path
                - '?'
                - '#' 
                - 'http://leantime.example.com'  # whitelist your own domain
                - 'https://leantime.example.com'
    condition: selection and not filter
level: medium

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2026-66414 Leantime Open Redirect Detected"; flow:to_server,established; content:"POST"; http_method; content:"/login"; http_uri; pcre:"/redirectUrl=https?:\/\/(?!leantime\.example\.com)/i"; classtype:attempted-recon; sid:1000001; rev:1;)

Note: Replace leantime.example.com with your actual domain in both Sigma and Suricata rules.

Remediation & Mitigation

1. Immediate workaround: Modify the Login.php controller to only allow relative redirects (e.g., $redirectUrl = ltrim($redirectUrl, '/') and check that no scheme/host is present). Alternatively, redirect to a hard‑coded safe page (e.g., /dashboard) after login.
2. Vendor patch: Leantime should release an update that properly validates redirectUrl against a whitelist or uses a signed token approach.
3. WAF rule: Implement a virtual patch to block redirectUrl containing external domains.
4. User awareness: Educate users to not click on unsolicited login links, especially those with suspicious redirect parameters.
5. Session hardening: Use secure, HTTP‑only cookies and regenerate session IDs after login.

Temporary code fix (if you can edit PHP files):

$rawRedirect = filter_input(INPUT_POST, 'redirectUrl', FILTER_SANITIZE_URL);
$redirectUrl = parse_url($rawRedirect);
if (!empty($redirectUrl['host']) && $redirectUrl['host'] !== $_SERVER['HTTP_HOST']) {
    $redirectUrl = '/';  // fallback
}

Valters IT – Your trusted DevSecOps & Cyber Threat Intelligence partner.