Open Redirect in Habitica

CVE-2022-23078

In habitica versions v4.119.0 through v4.232.2 are vulnerable to open redirect via the login page.

Vulnerability class: Open Redirect

EPSS: 0.011 (62.6th percentile) — read the EPSS interpretation.

Affected products

Habitica — versions v4.119.1, unspecified

Weakness classification (CWE)

CWE-601 — URL Redirection to Untrusted Site (Open Redirect)

References

vulnerabilitylab@mend.io (Patch, Third Party Advisory, x_refsource_MISC)
vulnerabilitylab@mend.io (Exploit, Third Party Advisory, x_refsource_MISC)