{"id":"CVE-2025-54066","aliases":["EUVD-2025-21778","GHSA-hfj7-542q-8fvv"],"status":"published","title":"DiracX-Web login page has Open Redirect vulnerability","description":"DiracX-Web is a web application that provides an interface to interact with the DiracX services. Prior to version 0.1.0-a8, an attacker can forge a request that they can pass to redirect an authenticated user to another arbitrary website. In the login page, DiracX-Web has a `redirect` field which is the location where the server will redirect the user. This URI is not verified, and can be an arbitrary URI. Paired with a parameter pollution, an attacker can hide their malicious URI. This could be used for phishing, and extract new data (such as redirecting to a new \"log in\" page, and asking another time credentials). Version 0.1.0-a8 fixes this vulnerability.","severity":{"version":"3.1","score":4.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00413,"percentile":0.36073,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-601"],"published":"2025-07-17T14:44:27Z","modified":"2026-10-28T02:30:47Z","fixes":[{"ecosystem":"npm","package":"@dirac-grid/diracx-web-components","fixed_in":["0.1.0-a8"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"@dirac-grid/diracx-web-components","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.1.0-a8"}]}]},{"source":"osv","ecosystem":"npm","package":"@dirac-grid/diracx-web-components","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.1.0-a8"}]}]}],"products":[{"vendor":"diracgrid","product":"diracx-web"}],"references":[{"url":"https://github.com/DIRACGrid/diracx-web/security/advisories/GHSA-hfj7-542q-8fvv","tags":["x_refsource_CONFIRM","advisory","web"]},{"url":"https://github.com/DIRACGrid/diracx-web/commit/eba3b7bc4f9d394074215986e6d3c15b546b25d5","tags":["x_refsource_MISC","fix","web"]},{"url":"https://diracx-cert.app.cern.ch/auth?redirect=https://ipcim.com/en/where/?dsdsd=qsqsfsjfnsfniizaeiaapzqlalkqkaizqqijsjaopmqmxna?redirect=https://diracx-cert-app.cern.ch/auth","tags":["x_refsource_MISC","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-54066","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-hfj7-542q-8fvv"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/54xxx/CVE-2025-54066.json","tags":["advisory"]},{"url":"https://github.com/DIRACGrid/diracx-web","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2025-54066","title":"DiracX-Web login page has Open Redirect vulnerability","description":"DiracX-Web is a web application that provides an interface to interact with the DiracX services. Prior to version 0.1.0-a8, an attacker can forge a request that they can pass to redirect an authenticated user to another arbitrary website. In the login page, DiracX-Web has a `redirect` field which is the location where the server will redirect the user. This URI is not verified, and can be an arbitrary URI. Paired with a parameter pollution, an attacker can hide their malicious URI. This could be used for phishing, and extract new data (such as redirecting to a new \"log in\" page, and asking another time credentials). Version 0.1.0-a8 fixes this vulnerability.","status":"published","published":"2025-07-17T14:44:27.982Z","modified":"2025-07-17T20:03:49.445Z","cvss":[{"version":"3.1","score":4.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-601"],"updated_at":"2026-11-02T14:32:27.932735Z"}],"euvd":[{"id":"EUVD-2025-21778","description":"DiracX-Web is a web application that provides an interface to interact with the DiracX services. Prior to version 0.1.0-a8, an attacker can forge a request that they can pass to redirect an authenticated user to another arbitrary website. In the login page, DiracX-Web has a `redirect` field which is the location where the server will redirect the user. This URI is not verified, and can be an arbitrary URI. Paired with a parameter pollution, an attacker can hide their malicious URI. This could be used for phishing, and extract new data (such as redirecting to a new \"log in\" page, and asking another time credentials). Version 0.1.0-a8 fixes this vulnerability.","status":"published","published":"2025-07-17T14:44:27Z","modified":"2025-07-17T20:03:49Z","cvss":[{"version":"3.1","score":4.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T20:32:07.018976Z"}],"ghsa":[{"id":"GHSA-hfj7-542q-8fvv","title":"DiracX-Web is vulnerable to attack through an Open Redirect on its login page","description":"### Summary\n\nAn attacker can forge a request to redirect an authenticated user to any arbitrary website.\n\n### Details\n\nOn the login page, we have a `redirect` field which is the location where the server will redirect the user. This URI is not verified, and can be an arbitrary URI.\n\nPaired with a parameter pollution, we can hide our malicious URI (ex: `https://dns.com/?param1=im_hidden_if_theres_lot_of_args?param1=bbb`).\n\n### PoC\n\nhttps://diracx-cert.app.cern.ch/auth?redirect=https://ipcim.com/en/where/?dsdsd=qsqsfsjfnsfniizaeiaapzqlalkqkaizqqijsjaopmqmxna?redirect=https://diracx-cert-app.cern.ch/auth\n\nThis POC can leak user's position.\n\n### Impact\n\nThis could be used for phishing and extracting new data (such as redirecting to a new \"log in\" page, and asking users to reenter credentials).","status":"published","published":"2025-07-17T19:40:59Z","modified":"2025-07-17T19:41:00Z","cvss":[{"version":"3.1","score":4.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N","level":"medium"}],"cwes":["CWE-601"],"updated_at":"2026-11-02T14:38:50.834587Z"}],"nvd":[{"id":"CVE-2025-54066","description":"DiracX-Web is a web application that provides an interface to interact with the DiracX services. Prior to version 0.1.0-a8, an attacker can forge a request that they can pass to redirect an authenticated user to another arbitrary website. In the login page, DiracX-Web has a `redirect` field which is the location where the server will redirect the user. This URI is not verified, and can be an arbitrary URI. Paired with a parameter pollution, an attacker can hide their malicious URI. This could be used for phishing, and extract new data (such as redirecting to a new \"log in\" page, and asking another time credentials). Version 0.1.0-a8 fixes this vulnerability.","status":"published","published":"2025-07-17T15:15:27.873Z","modified":"2026-06-17T09:39:21.687Z","cvss":[{"version":"3.1","score":4.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-601"],"updated_at":"2026-11-02T14:11:18.782156Z"}],"osv":[{"id":"CVE-2025-54066","title":"DiracX-Web login page has Open Redirect vulnerability","description":"DiracX-Web is a web application that provides an interface to interact with the DiracX services. Prior to version 0.1.0-a8, an attacker can forge a request that they can pass to redirect an authenticated user to another arbitrary website. In the login page, DiracX-Web has a `redirect` field which is the location where the server will redirect the user. This URI is not verified, and can be an arbitrary URI. Paired with a parameter pollution, an attacker can hide their malicious URI. This could be used for phishing, and extract new data (such as redirecting to a new \"log in\" page, and asking another time credentials). Version 0.1.0-a8 fixes this vulnerability.","status":"published","published":"2025-07-17T14:44:27.982Z","modified":"2026-10-28T02:30:47.145563408Z","cvss":[{"version":"3.1","score":4.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N","level":"medium"}],"cwes":["CWE-601"],"updated_at":"2026-11-02T15:44:50.863921Z"},{"id":"GHSA-hfj7-542q-8fvv","title":"DiracX-Web is vulnerable to attack through an Open Redirect on its login page","description":"### Summary\n\nAn attacker can forge a request to redirect an authenticated user to any arbitrary website.\n\n### Details\n\nOn the login page, we have a `redirect` field which is the location where the server will redirect the user. This URI is not verified, and can be an arbitrary URI.\n\nPaired with a parameter pollution, we can hide our malicious URI (ex: `https://dns.com/?param1=im_hidden_if_theres_lot_of_args?param1=bbb`).\n\n### PoC\n\nhttps://diracx-cert.app.cern.ch/auth?redirect=https://ipcim.com/en/where/?dsdsd=qsqsfsjfnsfniizaeiaapzqlalkqkaizqqijsjaopmqmxna?redirect=https://diracx-cert-app.cern.ch/auth\n\nThis POC can leak user's position.\n\n### Impact\n\nThis could be used for phishing and extracting new data (such as redirecting to a new \"log in\" page, and asking users to reenter credentials).","status":"published","published":"2025-07-17T19:40:59Z","modified":"2025-07-17T20:12:19.449066Z","cvss":[{"version":"3.1","score":4.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N","level":"medium"}],"cwes":["CWE-601"],"updated_at":"2026-11-02T15:46:48.920784Z"}]}}