CVE-2026-73671

Executive Summary

CVE-2026-73671 is an unauthenticated open redirect vulnerability (CWE-601, CVSS 6.1) in Saurus CMS Community Edition's logout handling code in classes/port.inc.php. The url parameter, supplied via GET or POST, is passed directly to the Location header without a domain allowlist, scheme validation, or relative-path enforcement, allowing an attacker to redirect authenticated users to arbitrary external domains or javascript: URIs after session destruction. Saurus CMS deployments are affected; no patch exists at the time of writing, and the impact is credential theft via phishing and OAuth redirect abuse.

Technical Analysis

The vulnerability is a classic unvalidated redirect / forward belonging to CWE-601. Per the NVD description, the flaw resides in the logout handling code in the file classes/port.inc.php. When a user initiates a logout, the CMS processes a url parameter obtained from the HTTP request — either GET or POST — and assigns its value verbatim to the HTTP Location header used in the redirect response. Three security controls are reported as missing:

1. Domain allowlist — the destination host is not checked against the CMS's own domain.
2. Scheme validation — protocols other than http/https, notably javascript:, are not rejected.
3. Relative path enforcement — the parameter is not restricted to internal paths beginning with /.

Because the url value is attacker-controlled and unvalidated, the redirect can point to any arbitrary external domain or to a javascript: URI. The attack does not require authentication (PR:N) and can be triggered remotely (AV:N); the only prerequisite is that the victim clicks the crafted link (UI:R). The CVSS vector reports Changed Scope (S:C), meaning the redirect impacts a security scope beyond the vulnerable CMS origin — typically the victim's browser session and the downstream authentication or OAuth flows it connects to. Confidentiality and integrity impact are both rated Low (C:L/I:L), consistent with a redirection primitive that facilitates phishing rather than direct code execution or privilege escalation.

Additional technical specifics beyond the NVD description are not available. The exact request path that maps to the logout handler, the full request routing, and the affected version range are not disclosed in the NVD record. Vulnerability-class behavior can be described with confidence, but implementation-level details such as the precise URL format required to trigger the handler should not be assumed. Attackers with access to a Saurus CMS instance can likely determine this by inspecting the application's logout links, but this remains unverified from the supplied data.

Exploitation Scenarios

No public PoC is available; the attack chain below is inferred from the vulnerability class and the NVD description.

1. Reconnaissance / target identification: The attacker identifies Saurus CMS Community Edition deployments using web fingerprinting (e.g., CMS meta generator tags, Shodan queries such as http.html:"Saurus CMS"). The attacker then inspects the logout functionality to confirm that a url parameter is accepted. Since the flaw is in classes/port.inc.php, the attacker only needs to confirm that logout requests honor an external redirect value.

2. Triggering the flaw: The attacker crafts a malicious logout URL containing a url parameter whose value is an absolute external domain (https://attacker.example) or a javascript: URI. The parameter can be delivered via GET or POST. POST delivery would typically require an auto-submitting HTML form; GET delivery enables a simple link. The crafted link is distributed via phishing email, messaging, or social media (MITRE T1566).

3. Payload / execution method: When the authenticated victim clicks the link, the CMS terminates the session and issues an HTTP redirect response with Location: <attacker-controlled value>. Because no validation occurs, the victim's browser is taken to the attacker's phishing page, or, in the case of a javascript: URI, script is executed in the context of the page depending on browser handling of protocol redirects. From the attacker's perspective, the trusted Saurus CMS origin is used as a redirector, lending legitimacy to the malicious link.

4. Post-exploitation impact: After redirect, the victim lands on a phishing page impersonating the CMS login or an upstream identity provider. With the legitimate session already destroyed, the victim is prompted to re-authenticate, entering credentials into the attacker-controlled page (credential theft). Where the CMS integrates with OAuth, the attacker can abuse the redirect to manipulate OAuth callback flows, potentially exchanging a legitimate authorization code for a token at an attacker-registered redirect URI.

Impact Assessment

• Business impact: Saurus CMS operators face reputational damage and abuse of their trusted domain as a vector for phishing. Because the redirect originates from the legitimate CMS host, URL reputation filters and email security gateways are less likely to block the crafted link.
• Affected systems: All Saurus CMS Community Edition deployments are presumed affected; the NVD record does not disclose a version range. The unpatched status (0/4 patch confidence) means every existing installation is exposed unless compensating controls are applied.
• Blast radius: CVSS base score 6.1 (Medium). The vector AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N indicates a low technical bar for the attacker (no privileges, trivial complexity) partially offset by the requirement for user interaction and the low confidentiality/integrity impact. There is no availability impact (A:N) and no evidence of direct server compromise.
• Exploitation likelihood: EPSS score 0.00223 (13.2nd percentile) suggests a low modeled probability of exploitation in the wild. The CVE is not listed on CISA KEV. No threat actor campaigns or exploit-in-the-wild evidence are known at the time of writing.

Detection Guidance

The rules below target the observable artifact of this vulnerability: HTTP requests to Saurus CMS containing a url parameter with an absolute external URI, a protocol-relative URI, or a javascript: scheme. Detection at the web server, logging, and network layers is appropriate because the vulnerable parameter is attacker-controlled in plaintext HTTP requests.

Sigma Rule

title: Saurus CMS Open Redirect via Logout url Parameter (CVE-2026-73671)
id: 3f7b0ddb-5d6e-4a1c-9f0a-2c8e7d6b4a51
status: experimental
description: >
  Detects HTTP requests referencing Saurus CMS logout handling where the url parameter
  is set to an absolute external URI or a non-http(s) scheme, matching the open redirect
  behavior described in CVE-2026-73671.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-73671
author: ValtersIT Threat Intelligence
date: 2026/05/15
logsource:
  category: webserver
  product: generic
detection:
  selection:
    cs-uri-query|contains:
      - "url=http://"
      - "url=https://"
      - "url=javascript:"
      - "url=//"
  filter_known_good:
    cs-uri-query|contains: "url=//cms.example.com"  # adjust to the CMS's own hostname
  condition: selection and not filter_known_good
falsepositives:
  - Logout redirects to the CMS's own domain (legitimate but should be removed once relative-path enforcement is patched)
  - URL-encoded values may bypass this basic query match and require normalization
level: high
tags:
  - attack.initial_access
  - attack.t1566
  - cwe.601
  - cve.2026.73671

YARA Rule

rule CVE_2026_73671_Saurus_CMS_Open_Redirect
{
    meta:
        author = "ValtersIT Threat Intelligence"
        date = "2026-05-15"
        description = "Detects HTTP access-log entries or captured web traffic indicating exploitation of CVE-2026-73671, the Saurus CMS open redirect"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-73671"
        cve = "CVE-2026-73671"
    strings:
        $script = "port.inc.php" ascii nocase
        $logout = "logout" ascii nocase
        $abs_http = "url=http://" ascii nocase
        $abs_https = "url=https://" ascii nocase
        $scheme_js = "url=javascript:" ascii nocase
        $proto_rel = "url=//" ascii
    condition:
        ($script or $logout) and any of ($abs_http, $abs_https, $scheme_js, $proto_rel)
}

Suricata IDS Rule

alert http any any -> $HOME_NET any (
  msg:"CVE-2026-73671 Saurus CMS Open Redirect Attempt (logout url parameter)";
  flow:to_server,established;
  http.uri;
  content:"url=";
  pcre:"/[?&]url=(javascript:|https?:\/\/|\/\/[^\/])/i";
  metadata:created_at 2026_05_15, updated_at 2026_05_15;
  reference:cve,2026-73671;
  classtype:web-application-attack;
  sid:202673671;
  rev:1;
)

Elastic Detection

any where event.category == "web" and
  url.query != null and
  url.query contains "url=" and
  (
    url.query contains "url=http://" or
    url.query contains "url=https://" or
    url.query contains "url=javascript:" or
    url.query contains "url=//"
  )

This EQL query flags web events where the request query string carries a url parameter pointing to an absolute external URI, a protocol-relative URI, or a javascript: scheme. For additional precision, join on the CMS hostname or correlate with requests to the Saurus CMS logout handler.

Splunk SPL Query

index=web sourcetype=access_combined
| where isnotnull(uri_query)
    AND like(uri_query, "%url=%")
    AND (like(uri_query, "%url=http://%")
      OR like(uri_query, "%url=https://%")
      OR like(uri_query, "%url=javascript:%")
      OR like(uri_query, "%url=//%"))
| stats count, earliest(_time) AS first_seen, latest(_time) AS last_seen
    BY src_ip, uri_path, uri_query, http_user_agent
| sort - count

Wazuh OSSEC Rule

<group name="web,attack,">
  <rule id="157746" level="10">
    <match>url=</match>
    <regex>url=(https?:\/\/|javascript:|//)</regex>
    <description>CVE-2026-73671: Saurus CMS open redirect exploitation attempt detected</description>
    <group>web_application_attack,</group>
    <mitre>
      <id>T1566</id>
    </mitre>
  </rule>
</group>

Note: Wazuh rule IDs must be unique per deployment; adjust id="10073671" if it collides with existing local rules. The rule matches decoded Apache/HSRP access log lines containing the url parameter with an external or script scheme.

Mitigation & Patch Guidance

Patch status: UNPATCHED. Patch confidence is 0/4 — no vendor advisory, no fixed version, and no patch source identified. The following guidance is therefore layered and compensating.

1. Immediate mitigations:

   • Deploy a WAF or reverse-proxy rule that blocks the url parameter on logout-related requests when its value is an absolute URI (http://, https://), a protocol-relative path (//), or a javascript: scheme. Allow only relative paths beginning with a single /.
   • If the deployment can be modified at code level, harden the logout handler so the Location header always points to a fixed internal path or to the CMS root, ignoring user-supplied redirect values.
   • Apply the same blocking logic to both GET and POST requests, since the parameter is accepted in either method.

2. Patch / upgrade steps:

   • Monitor the project's release channels for a security advisory addressing CVE-2026-73671. As of this report, no fixed version exists.
   • If the organization operates a fork of Saurus CMS Community Edition, implement and test a patch that validates the url parameter against a domain allowlist, restricts allowed schemes to http/https, and requires the value to be a relative path.

3. Long-term hardening:

   • Reduce reliance on anchor-domain redirects by centralizing authentication through an identity provider that enforces strict OAuth redirect_uri allowlists.
   • Deploy phishing-resistant multi-factor authentication so that harvested credentials alone are insufficient for account takeover.
   • Normalize and decode URI-encoded parameters in logging pipelines so that detection rules continue to fire on encoded bypass attempts.
   • Maintain web-application inventory and sensor coverage (Sigma/Suricata/EQL/SPL) so that post-patch regression attempts are detected.

References

• NVD entry for CVE-2026-73671: https://nvd.nist.gov/vuln/detail/CVE-2026-73671
• MITRE CWE-601 (URL Redirection to Untrusted Site): https://cwe.mitre.org/data/definitions/601.html
• FIRST CVSS v3.1 calculator with the referenced vector: https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
• OWASP Open Redirect community page: https://owasp.org/www-community/attacks/Open_redirect
• No vendor advisory, CISA KEV listing, or known in-the-wild exploitation campaign is available for this CVE at the time of writing.