Description

A vulnerability has been found in CTFd up to 3.8.4. The affected element is the function _is_safe_url of the file CTFd/utils/validators/__init__.py. Such manipulation of the argument Next leads to open redirect. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The name of the patch is 5d8515842fd1ab2c3a9f2dde9ffca907aa334ea9. Upgrading the affected component is recommended.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-08-23T23:16:46.043Z",
  "pubdate": "2026-08-23T23:16:46.043Z",
  "executiveSummary": "An open redirect vulnerability has been identified in CTFd up to version 3.8.4, specifically within the validation logic responsible for verifying destination URLs. The vulnerability stems from insufficient sanitization of the Next argument processed by the application. This security flaw enables remote attackers to manipulate redirection parameters, leading users to arbitrary external domains or malicious third-party websites under the attacker's control.\nThe risk implication of this vulnerability is moderate to high, as it is commonly leveraged in phishing campaigns, social engineering attacks, and credential harvesting schemes where victims are deceived into believing they are navigating within the legitimate CTFd platform. Exploitation of this flaw can be initiated remotely without requiring prior authentication or specialized privileges on the target system, provided the victim interacts with a specially crafted malicious link. The availability of publicly disclosed exploit details increases the likelihood of active exploitation attempts against unpatched instances, making timely remediation critical for maintaining operational security.",
  "technicalDetails": "The vulnerability resides in the function _is_safe_url located within the file CTFd/utils/validators/__init__.py. The root cause of the issue is inadequate validation and parsing of the Next argument supplied via HTTP requests, which fails to correctly restrict redirection targets to trusted internal application routes or domain boundaries.\nNetwork exposure is fully remote, allowing unauthenticated threat actors to construct and distribute malicious hyperlinks targeting exposed CTFd instances running affected versions up to 3.8.4. The attack vector relies on tricking a legitimate user into clicking a crafted URL containing an arbitrary external domain or protocol within the vulnerable parameter. Upon processing the request, the flawed validation logic incorrectly evaluates the untrusted input as a safe destination, causing the application to issue an HTTP redirect response pointing to the attacker-specified location.\nThe step-by-step attack flow proceeds as follows: First, the attacker crafts a malicious URL pointing to a legitimate CTFd instance but appends a manipulated Next parameter containing a fully qualified external URL or obfuscated redirection payload. Second, the victim intercepts and clicks the crafted link, initiating an HTTP request to the vulnerable CTFd server. Third, the application invokes the vulnerable function _is_safe_url to evaluate the redirection target. Fourth, due to parsing flaws in the validation mechanism, the function fails to detect the malicious nature of the external URL and validates it as safe. Fifth, the server responds with an HTTP redirection status code directing the user's browser to the external malicious destination.\nPost-exploitation impact primarily centers on client-side attacks. While the vulnerability does not directly permit remote code execution on the server or unauthorized database access, it significantly enhances the efficacy of social engineering campaigns. Attackers can exploit user trust in the legitimate CTFd domain to facilitate credential theft, malware distribution, or further compromise through sophisticated phishing vectors."
}