OnboardLite Open Redirect Endpoint
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Active
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Spoofing
- Confidentiality · integrity · availability
- None · Low · None
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-601.
Summary
OnboardLite is the result of the Influx Initiative, our vision for an improved student organization lifecycle at the University of Central Florida. An attacker can craft a link to the trusted application that, when visited, redirects the user to a malicious external site. This enables phishing, credential theft, malware delivery, and trust abuse. Any version with commit hash 6cca19e or later implements jwt signing for the redirect url parameter.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| HackUCF | OnboardLite | before 6cca19ea4f47af125caa08ef82594844f039e07e | 6cca19ea4f47af125caa08ef82594844f039e07e | Patch available | CNA |
- OnboardLite VendorHackUCF Affected before 6cca19ea4f47af125caa08ef82594844f039e07e Fixed in 6cca19ea4f47af125caa08ef82594844f039e07e Patch available CNA
Remediation
- Fix · CNA OnboardLite (HackUCF) Fixed in 6cca19ea4f47af125caa08ef82594844f039e07e
Timeline
- 2026-10-02 Threatist record created from CVE-2025-55751
References
More HackUCF vulnerabilities
- TI-2026-19238 OnboardLite has stored Cross-site Scripting issue that may lead to admin Account Take Over CVSS 3.1HIGH 7.3
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences