Read the docs
TI-2026-10630 Aliases CVE-2026-12379GHSA-qwf3-2mwh-ccxc

URL Redirection to Untrusted Site ('Open Redirect') vulnerability in the Dashboard OAuth/OIDC implementation of Axivion

Priority LOW 29CWE-601Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
Passive
Attack complexity
Low
Attack requirements
None
Impact type
Spoofing
Confidentiality · integrity · availability
High · None · None
Fix status
No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-601.

Summary

An Open Redirect vulnerability (CWE-601) exists in the OAuth/OIDC authentication implementation of the Axivion Dashboard. The login flow did not properly restrict the post-authentication redirect to the application's own origin, so a user who follows a crafted login link can be sent to an untrusted external site after authenticating against the genuine Dashboard. Because the link points at the legitimate Dashboard, this can be abused for phishing, for example credential or second-factor theft via a convincing look-alike page. Exploitation requires the victim to follow the attacker-supplied link and complete the authentication flow.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00207 10th percentileScored 2026-11-08
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
qtAxivion7.8.0 – 7.8.12; 7.9.0 – 7.9.12; 7.10.0 – 7.10.10; 7.11.0 – 7.11.6; 7.12.0 – 7.12.1—No fix listedCNA
  • Axivion Vendorqt Affected 7.8.0 – 7.8.12; 7.9.0 – 7.9.12; 7.10.0 – 7.10.10; 7.11.0 – 7.11.6; 7.12.0 – 7.12.1 Fixed in — No fix listed CNA

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-12379
  2. 2026-10-03 Alias added: GHSA-qwf3-2mwh-ccxc

References

Other 1

  • TI-2024-23902 QAbstractOAuth in Qt Network Authorization in Qt before 5.15.17, 6.x before 6.2.13, 6.3.x… CVSS 3.1CRITICAL 9.8
  • TI-2022-21359 Heap-based buffer overflow in Qt CVSS 3.1HIGH 8.8
  • TI-2022-19524 Integer overflow in Qt CVSS 3.1HIGH 8.8
  • TI-2023-18997 In Qt before 5.15.15, 6.x before 6.2.9, and 6.3.x through 6.5.x before 6.5.2, there can… CVSS 3.1HIGH 7.5
  • TI-2021-09305 Integer Overflow vulnerability in qsvghandler.cpp in Qt qtsvg versions 5.15.1, 6.0.0… CVSS 3.1MEDIUM 5.5
  • TI-2023-28356 An issue was discovered in the HTTP2 implementation in Qt before 5.15.17, 6.x before… CVSS 3.1CRITICAL 9.8
See all 106 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences