{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-61637", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-07-10T17:38:57.111Z", "datePublished": "2026-11-11T18:26:59.587Z", "dateUpdated": "2026-11-11T18:26:59.587Z"}, "containers": {"cna": {"title": "Icinga Web 2: Open redirect on login page, under certain circumstances", "problemTypes": [{"descriptions": [{"cweId": "CWE-601", "lang": "en", "description": "CWE-601: URL Redirection to Untrusted Site", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 3.5, "baseSeverity": "LOW", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/Icinga/icingaweb2/security/advisories/GHSA-w7c2-xjv9-q8fv", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/Icinga/icingaweb2/security/advisories/GHSA-w7c2-xjv9-q8fv"}], "affected": [{"vendor": "Icinga", "product": "icingaweb2", "versions": [{"version": "< 2.12.7", "status": "affected"}, {"version": "< 2.13.1", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-11-11T18:26:59.587Z"}, "descriptions": [{"lang": "en", "value": "Icinga Web 2 is an open source monitoring web interface, framework and command-line interface. Prior to versions 2.12.7 and 2.13.1, an attacker can craft a URL that, once visited by an authenticated user (or one that is able to authenticate), allows to manipulate the backend to redirect the user to any location. For this to succeed, the victim's locale in Icinga Web must be different from en_US. This issue has been patched in versions 2.12.7 and 2.13.1."}], "source": {"advisory": "GHSA-w7c2-xjv9-q8fv", "discovery": "UNKNOWN"}}}}

{}

{"affected": [{"affectedData": [{"product": "icingaweb2", "vendor": "Icinga", "versions": [{"status": "affected", "version": "< 2.12.7"}, {"status": "affected", "version": "< 2.13.1"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Icinga Web 2 is an open source monitoring web interface, framework and command-line interface. Prior to versions 2.12.7 and 2.13.1, an attacker can craft a URL that, once visited by an authenticated user (or one that is able to authenticate), allows to manipulate the backend to redirect the user to any location. For this to succeed, the victim's locale in Icinga Web must be different from en_US. This issue has been patched in versions 2.12.7 and 2.13.1."}], "id": "CVE-2026-61637", "lastModified": "2026-11-11T19:17:42.887", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 3.5, "baseSeverity": "LOW", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.1, "impactScore": 1.4, "source": "security-advisories@github.com", "type": "Secondary"}]}, "published": "2026-11-11T19:17:42.887", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/Icinga/icingaweb2/security/advisories/GHSA-w7c2-xjv9-q8fv"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Received", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-601"}], "source": "security-advisories@github.com", "type": "Primary"}]}

{}

{}