CVE-2026-40080
CVE-2026-40080 · Cacti: Open Redirect via HTTP_REFERER substring check in auth_login_redirect
This page contains facts from public vulnerability sources. Check the original advisory before updating.
Cacti is an open source performance and fault management framework. Versions 1.2.30 and prior are vulnerable to Open Redirect through a substring check rather than a host check at str_contains($referer, CACTI_PATH_URL). When the user's login_opts == '1' (redirect to referer after login), the function used $_SERVER['HTTP_REFERER'] directly. An attacker could craft a referer such as https://evil.com/cacti/. Where CACTI_PATH_URL is /cacti/, the substring matches and the user is redirected to evil.com after login. The pre-existing validate_redirect_url() helper at lib/html_utility.php performed proper validation but was not invoked from auth_login_redirect(). This issue has been fixed in version 1.2.31.
CVSS 6.1 · Medium · EPSS 0.3% · Fix available
- Published
- Updated
Stack: system
Affected products and versions
cacti
- Versions
- < 1.2.31: Affected
No fix published
cacti Debian:12
- Versions
- 1.2.24+ds1-1
- 1.2.24+ds1-1+deb12u1
- 1.2.24+ds1-1+deb12u2
- 1.2.24+ds1-1+deb12u3
- 1.2.24+ds1-1+deb12u4
- 1.2.24+ds1-1+deb12u5
- 1.2.25+ds1-1
- 1.2.25+ds1-2
- 1.2.26+ds1-1
- 1.2.27+ds1-1
- 1.2.27+ds1-2
- 1.2.28+ds1-1
- 1.2.28+ds1-2
- 1.2.28+ds1-3
- 1.2.28+ds1-4
- 1.2.30+ds1-1
- 1.2.30+ds1-2
- 1.2.30+ds1-3
- 1.2.31+ds1-1
- 1.2.31+ds1-2
- 1.2.31+ds1-3
- 1.2.31+ds1-4
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
cacti Debian:13
- Versions
- 1.2.30+ds1-1
- 1.2.30+ds1-2
- 1.2.30+ds1-3
- 1.2.31+ds1-1
- 1.2.31+ds1-2
- 1.2.31+ds1-3
- 1.2.31+ds1-4
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
cacti Debian:14
- Versions
- 1.2.30+ds1-1
- 1.2.30+ds1-2
- 1.2.30+ds1-3
- Affected ranges
- ECOSYSTEM: < 1.2.31+ds1-1
Update to 1.2.31+ds1-1
cacti Ubuntu:Pro:14.04:LTS
- Versions
- 0.8.8b+dfsg-3
- 0.8.8b+dfsg-5
- 0.8.8b+dfsg-5ubuntu0.1
- 0.8.8b+dfsg-5ubuntu0.2
- 0.8.8b+dfsg-5ubuntu0.2+esm1
- 0.8.8b+dfsg-5ubuntu0.2+esm2
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
cacti Ubuntu:Pro:16.04:LTS
- Versions
- 0.8.8f+ds1-2
- 0.8.8f+ds1-3
- 0.8.8f+ds1-4
- 0.8.8f+ds1-4ubuntu1
- 0.8.8f+ds1-4ubuntu2
- 0.8.8f+ds1-4ubuntu3
- 0.8.8f+ds1-4ubuntu4
- 0.8.8f+ds1-4ubuntu4.16.04
- 0.8.8f+ds1-4ubuntu4.16.04.1
- 0.8.8f+ds1-4ubuntu4.16.04.2
- 0.8.8f+ds1-4ubuntu4.16.04.2+esm1
- 0.8.8f+ds1-4ubuntu4.16.04.2+esm2
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
cacti Ubuntu:Pro:18.04:LTS
- Versions
- 1.1.18+ds1-1
- 1.1.27+ds1-2
- 1.1.27+ds1-3
- 1.1.28+ds1-2
- 1.1.35+ds1-1
- 1.1.36+ds1-1
- 1.1.38+ds1-1
- 1.1.38+ds1-1ubuntu0.1~esm1
- 1.1.38+ds1-1ubuntu0.1~esm3
- 1.1.38+ds1-1ubuntu0.1~esm4
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
cacti Ubuntu:Pro:20.04:LTS
- Versions
- 1.2.4+ds1-2ubuntu3
- 1.2.9+ds1-1ubuntu1
- 1.2.9+ds1-1ubuntu2
- 1.2.10+ds1-1ubuntu1
- 1.2.10+ds1-1ubuntu1+esm1
- 1.2.10+ds1-1ubuntu1.1
- 1.2.10+ds1-1ubuntu1.1+esm1
- 1.2.10+ds1-1ubuntu1.1+esm2
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
cacti Ubuntu:Pro:22.04:LTS
- Versions
- 1.2.16+ds1-2ubuntu1
- 1.2.19+ds1-2ubuntu1
- 1.2.19+ds1-2ubuntu1+esm1
- 1.2.19+ds1-2ubuntu1.1
- 1.2.19+ds1-2ubuntu1.1+esm1
- 1.2.19+ds1-2ubuntu1.1+esm2
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
cacti Ubuntu:24.04:LTS
- Versions
- 1.2.25+ds1-2
- 1.2.26+ds1-1
- 1.2.26+ds1-1ubuntu0.1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
cacti Ubuntu:25.10
- Versions
- 1.2.28+ds1-4ubuntu1
- 1.2.30+ds1-1ubuntu1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
cacti Ubuntu:26.10
- Versions
- 1.2.30+ds1-1ubuntu2
- 1.2.30+ds1-1ubuntu3
- 1.2.31+ds1-3ubuntu2
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
cacti Ubuntu:26.04:LTS
- Versions
- 1.2.30+ds1-1ubuntu1
- 1.2.30+ds1-1ubuntu2
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published