CVE-2026-28301
4.8 MEDIUMA vulnerability in which an attacker can provide a crafted external URL that may redirect a user to an unintended website
Published: 2026-06-09 · Last updated: 2026-06-09
Severity and scoring
- CVSS
- 4.8 MEDIUM
- Vector
- CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
- CWE
- CWE-601
Description
A vulnerability in which an attacker can provide a crafted external URL that may redirect a user to an unintended website.
Source: NVD
References
- [NVD]https://nvd.nist.gov/vuln/detail/CVE-2026-28301
- [Other]https://documentation.solarwinds.com/en/success_center/orionplatform/content/core-secure-configuration.htm
- [Other]https://documentation.solarwinds.com/en/success_center/orionplatform/content/release_notes/hco_2026-2_release_notes.htm
- [Other]https://www.solarwinds.com/trust-center/security-advisories/CVE-2026-28301
Related CVEs
Same CWE
- CVE-2026-41706 — Spring Security's CookieRequestCache and CookieServerRequestCache store the pre-authentication request URL in a browser cookie so that us... (6.1 MEDIUM)
- CVE-2026-41008 — Spring Security Authorization Server's authorization endpoint performs insufficient validation of the request_uri parameter (6.1 MEDIUM)
- CVE-2026-47991 — Adobe Experience Manager versions 6.5.24, LTS SP1, 2026.04 and earlier are affected by an Improper Redirect (Open Redirect) vulnerability... (4.3 MEDIUM)
- CVE-2026-47347 — Applications that use GeneralUtility::sanitizeLocalUrl to allow only local URLs are vulnerable to open redirect attacks if the URL is use...
- CVE-2026-41844 — A Spring MVC or Spring WebFlux application which configures a mapping for "/**" where the view name is not explicitly specified allows an... (4.2 MEDIUM)