What is CVE-2024-58389?

CVE-2024-58389 is a medium-severity vulnerability in Holoviz Panel, classified under URL Redirection to Untrusted Site (Open Redirect). CVSS score: 6.1/10. Published 2026-10-12.

How severe is CVE-2024-58389?

Medium severity. CVSS v3 base score is 6.1 out of 10.

Open Redirect in Holoviz Panel

CVE-2024-58389

HoloViz Panel from 1.2.2 before 1.9.0 contains an open redirect vulnerability in panel/auth.py that allows remote attackers to redirect users by supplying an unvalidated next query parameter. BasicLoginHandler and PasswordLoginHandler store the parameter in a next_url cookie, so crafted login links send victims to attacker-controlled external sites after successful login.

Vulnerability class: Open Redirect

Published 2026-10-12.

CVSS v3 metric

CVSS v3 base score 6.1 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N.

EPSS exploit prediction

No EPSS score from FIRST.org yet. New CVEs usually get one within a few days; no score means no signal yet, not low risk. How EPSS works.

Affected products

Holoviz Panel

Weakness classification (CWE)

CWE-601 — URL Redirection to Untrusted Site (Open Redirect)

References

github.com/holoviz/panel/issues/6782 (issue-tracking)
github.com/holoviz/panel/commit/a6a8b2cb9592a014cf6a7b0d3d5fc9cbf59bb2ed (patch)
github.com/holoviz/panel/blob/v1.8.10/panel/auth.py (technical-description)
github.com/holoviz/panel (product)
www.vulncheck.com/advisories/holoviz-panel-from-1.2.2-before-1.9.0-open-redirec… (third-party-advisory)

Frequently asked questions

What is CVE-2024-58389?: CVE-2024-58389 is a medium-severity vulnerability in Holoviz Panel, classified under URL Redirection to Untrusted Site (Open Redirect). CVSS score: 6.1/10. Published 2026-10-12.
How severe is CVE-2024-58389?: Medium severity. CVSS v3 base score is 6.1 out of 10.