What is CVE-2026-66414?

CVE-2026-66414 is a medium-severity vulnerability in Leantime, classified under URL Redirection to Untrusted Site (Open Redirect). CVSS score: 6.1/10. Published 2026-07-30.

How severe is CVE-2026-66414?

Medium severity. CVSS v3 base score is 6.1 out of 10.

Open Redirect in Leantime

CVE-2026-66414

Leantime 3.6.2 contains an open redirect vulnerability in the Login controller that allows unauthenticated attackers to redirect authenticated users to arbitrary external sites by manipulating the redirectUrl POST parameter. Attackers can…

Vulnerability class: Open Redirect

CVSS v3 metric

CVSS v3 base score 6.1 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N.

Affected products

Leantime — versions 0

Weakness classification (CWE)

CWE-601 — URL Redirection to Untrusted Site (Open Redirect)

References

disclosure@vulncheck.com (issue-tracking)
disclosure@vulncheck.com (vendor-advisory)
disclosure@vulncheck.com (product)
disclosure@vulncheck.com (third-party-advisory)

Frequently asked questions

What is CVE-2026-66414?: CVE-2026-66414 is a medium-severity vulnerability in Leantime, classified under URL Redirection to Untrusted Site (Open Redirect). CVSS score: 6.1/10. Published 2026-07-30.
How severe is CVE-2026-66414?: Medium severity. CVSS v3 base score is 6.1 out of 10.