Description

URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Mehul Gohil Aculect AI Companion aculect-ai-companion allows Phishing.This issue affects Aculect AI Companion: from n/a through 0.8.1.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.7",
  "pubDate": "2026-10-02T15:17:09.763Z",
  "pubdate": "2026-10-02T15:17:09.763Z",
  "executiveSummary": "The Aculect AI Companion is susceptible to a URL Redirection to Untrusted Site (Open Redirect) vulnerability, classified under CWE-601.\nThis vulnerability exists within versions ranging from n/a through 0.8.1.\nThe flaw allows an unauthenticated or authenticated attacker to craft malicious URLs that leverage the application's redirection functionality to redirect users to arbitrary, potentially malicious external domains.\nThe primary risk implication is the facilitation of phishing campaigns, where attackers masquerade as a trusted entity by utilizing a legitimate application URL to redirect victims to a controlled destination designed for credential harvesting, malware distribution, or social engineering.\nExploitation does not typically require deep technical access, merely the ability to deliver a crafted link to an unsuspecting user.\nThis flaw compromises user trust in the application and increases the attack surface for secondary malicious activities.",
  "technicalDetails": "The root cause of the vulnerability lies in the application's failure to adequately validate or sanitize user-supplied input before using it to construct a redirection response.\nSpecifically, the application accepts a URL parameter, likely in a HTTP GET or POST request, that controls the destination of an HTTP 3xx redirect. The application logic fails to restrict this parameter to a known-good allowlist of trusted domains, enabling an attacker to specify any external URL.\nIn a typical attack flow, the attacker identifies a legitimate URL for the Aculect AI Companion that performs a redirection—for example, 'https://vulnerable-aculect-app.com/redirect?url=https://legitimate-site.com'.\nThe attacker modifies the 'url' parameter to point to a malicious domain, such as 'https://attacker-controlled-site.com'.\nWhen a user clicks the malicious link (e.g., 'https://vulnerable-aculect-app.com/redirect?url=https://attacker-controlled-site.com'), the application processes the request and issues a HTTP redirection response to the browser.\nBecause the initial request originates from the trusted domain of the Aculect AI Companion, the victim is more likely to trust the legitimacy of the link, bypassing human-centric security controls.\nThis vulnerability affects all Aculect AI Companion versions from n/a through 0.8.1.\nThere are no complex privilege requirements, as the vulnerability is triggered by user interaction via a link, making it easily weaponized for large-scale phishing campaigns.\nPost-exploitation impact includes the successful redirection of users to phishing sites, facilitating the theft of sensitive user credentials, session tokens, or the installation of malicious software.\nThe flaw is inherently exposed to the network, as the redirection mechanism must be publicly accessible to perform its intended function, meaning any remote attacker can craft and distribute these links."
}