Description

reset_password.html parses query string parameters and uses the 'url' parameter as a redirection target (window.location = url) after password reset, optionally delayed by a 'delay' parameter. No validation or allowlisting is performed on url, enabling an attacker to redirect users to an arbitrary external site after completion of the password-reset workflow.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-09-02T09:16:38.247Z",
  "pubdate": "2026-09-02T09:16:38.247Z",
  "executiveSummary": "The reset_password.html component is vulnerable to an open redirect vulnerability caused by improper input validation of the 'url' query string parameter. This flaw allows an attacker to manipulate the redirection logic following a successful password reset event, directing users to arbitrary, potentially malicious external websites.\nThis vulnerability constitutes an Open Redirect, classified under CWE-601. The impact is significant, as attackers can leverage the trusted context of the legitimate application to facilitate phishing attacks, credential harvesting, or malware distribution.\nThe vulnerability is exploitable by unauthenticated attackers, provided they can influence a user to click a crafted link. Because the redirection occurs within the context of an established password reset workflow, users are more likely to perceive the destination site as trustworthy, increasing the success rate of social engineering efforts.\nThe risk is exacerbated by the absence of a server-side or client-side allowlist mechanism to constrain the 'url' parameter to authorized domains. Remediation requires implementing strict validation logic to ensure redirection targets conform to pre-approved application paths or domains.",
  "technicalDetails": "The root cause of this vulnerability is the insecure implementation of client-side redirection logic within reset_password.html. Specifically, the application directly processes the 'url' parameter from the query string and assigns it to the window.location property without validation or sanitation.\nWhen a user accesses the reset_password.html page, the script extracts the 'url' parameter value. Upon completion of the password reset process, the script executes a redirection using this user-supplied input. If a 'delay' parameter is provided, the redirection is deferred, but the destination remains entirely controlled by the input parameter.\nAn attacker can exploit this by crafting a malicious URL such as 'reset_password.html?url=https://attacker-controlled-site.com'. When a victim follows this link—often disguised through URL shorteners or embedded in phishing emails—the application appears legitimate. Once the victim completes the password reset, the browser script automatically navigates the victim to the attacker's site.\nThe attack flow is as follows: 1. The attacker identifies the vulnerable reset_password.html endpoint. 2. The attacker constructs a crafted URL with the 'url' parameter pointing to a malicious domain. 3. The attacker distributes this URL to the victim. 4. The victim, interacting with the reset process, triggers the script. 5. The vulnerable script executes 'window.location = url', moving the victim to the attacker-supplied domain.\nThe vulnerability is exposed at the client-side level via standard HTTP(S) protocols. No authentication is required for an attacker to initiate this redirection, as the vulnerable script executes before or during the user's interaction with the reset flow. The lack of an allowlist or indirect reference map allows for unrestricted redirection to any external URI, including those using different protocols (e.g., 'javascript:' pseudo-protocols if the application is not carefully hardened against XSS via redirect handlers).\nPost-exploitation, the impact is primarily centered on social engineering. By utilizing the trust established by the legitimate domain, the attacker can redirect the user to a spoofed login page to capture new credentials or execute browser-based exploits on the destination page."
}