Open Redirect in Saltcorn

CVE-2026-42259

Saltcorn is an extensible, open source, no-code database application builder. Prior to versions 1.4.6, 1.5.6, and 1.6.0-beta.5, Saltcorn validates the post-login dest parameter with a string check that only blocks :/ and //. Because all WH…

Vulnerability class: Open Redirect

EPSS: 0.003 (26.1th percentile) — read the EPSS interpretation.

Affected products

  • Saltcorn — versions < 1.4.6, >= 1.5.0-beta.0, < 1.5.6, >= 1.6.0-alpha.0, < 1.6.0-beta.5

Weakness classification (CWE)

References