[adulau]

A successful website login redirects directly to the user-supplied next URL. This remains unfixed at upstream HEAD 0d56f9c2da50adbbb1b3c977e571344953b820bd and is also present in release v3.1.4. A regression test using the real login form, valid CSRF token and administrator password reproduced a 302 with Location: https://evil.example/phish before this patch. Addresses the issue reported in #872.

Validate the destination and emit only a local path. Preserve ordinary local destinations and convert HTTP(S) URLs with the same host and port to local paths, retaining queries and fragments. Reject external authorities, userinfo, unsupported or malformed schemes, browser-ambiguous slash/backslash forms, control characters and malformed URLs; fall back to /.

The netloc-only check proposed in #872 also accepts https:///evil.example/phish because Python parses an empty netloc. Flask emits that Location unchanged, and a WHATWG URL parser resolves it to https://evil.example/phish. This patch rejects that form and normalizes accepted destinations before redirecting.

Validation

• Confirmed the external-redirect regression fails against the unmodified HEAD and passes with this fix.
• PYTHONPATH=website/tests .venv/bin/python -m unittest login_checks external_tools_checks import_checks export_checks -q — 42 tests passed.
• Eight new login tests include subtests for unsafe and valid URL forms, actual Flask-Login protected-page redirects, same-host ports, successful authentication, wrong passwords, CSRF and remember-me behavior. They are included automatically by the existing website CI pattern.
• Black, isort, flake8 and git diff --check passed for the changed files.

Security advisory assessment

Recommendation: publish a security advisory and request a CVE and/or GCVE identifier through the responsible CNA/GNA. This is a reproducible CWE-601 open redirect in the optional standalone website. A remote attacker can craft a login URL that sends a victim to an attacker-controlled site after the victim successfully authenticates, increasing the credibility of a phishing flow. The demonstrated behavior does not automatically disclose the submitted password or session cookie.

Confirmed affected source: v3.1.4 and the checked upstream HEAD. The vulnerable login redirect was introduced in 4426a51193973b1c0a6e8614b5d3ee8e797f91bc (2024-02-29). Earlier affected release bounds and the first fixed release should be confirmed when publishing the advisory. The issue concerns the Flask website, rather than the module daemon alone or the separate MISP core login implementation.

Identifier assignment is a CNA/GNA decision, rather than an automatic consequence of opening this PR. CNA rules §4.2.2 support assignment for evidenced, publicly disclosed vulnerabilities within scope; GCVE BCP-04 describes GNA allocation and cross-referencing. No matching public identifier was found in the searches performed; check existing reservations before requesting a new one. This PR does not allocate or publish an advisory identifier.

[chatgpt-codex-connector]

Codex Review Summary: ✅ Completed

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-11-13T05:52:44.741471Z	d115f00	PR opened
🔒 Security Review	✅ Completed 2026-11-13T05:53:14.501948Z	d115f00	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[adulau]

Security advisory https://vulnerability.circl.lu/vuln/gcve-1-2026-20325