CVE-2025-60935: 
Homebrew vulnerability analysis and mitigation

CVE-2025-60935 is an open redirect vulnerability (CWE-601) in the login endpoint of Blitz Panel v1.17.0, a management panel for the Hysteria2 proxy server developed by ReturnFI. The flaw allows unauthenticated attackers to redirect authenticated users to attacker-controlled external domains via a crafted next_url parameter in the login URL. The vulnerability was discovered by Kanishka De Silva, confirmed by the project maintainer on August 30, 2025, and published to NVD on December 24, 2025. It carries a CVSS v3.1 base score of 6.1 (Medium) (GitHub Gist, Red Hat CVE).

The root cause is insufficient validation of the next_url parameter in the /login endpoint (CWE-601: URL Redirection to Untrusted Site). After a user successfully authenticates, the application blindly redirects to the value supplied in next_url without verifying that the destination is a trusted domain. An attacker crafts a login URL such as https://domain:port/login?next_url=https://evil.com and distributes it to targets; upon successful login, the victim is transparently forwarded to the malicious site. No authentication or special privileges are required to craft the malicious URL, though user interaction (clicking the link and logging in) is necessary for exploitation (GitHub Gist).

Successful exploitation enables phishing attacks by redirecting users to convincing lookalike sites immediately after they authenticate, increasing the likelihood of credential or token harvesting. Session tokens or authentication artifacts present in the redirect flow may be exposed to the attacker-controlled domain via HTTP Referer headers or URL fragments. The vulnerability has limited direct impact on confidentiality and integrity (low each) and no availability impact, but the post-authentication timing makes social engineering attacks particularly effective (GitHub Gist, Red Hat CVE).

No evidence of in-the-wild exploitation has been reported, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. A public proof-of-concept disclosure exists as a GitHub Gist authored by the discoverer (HEXER365), which documents the affected parameter and provides an example exploit URL. The EPSS score is approximately 0.074% (0.000740), indicating a low probability of near-term exploitation. User interaction is required, limiting automated mass exploitation (GitHub Gist).

1. Reconnaissance: Identify publicly accessible Blitz Panel instances running version 1.17.0 using internet scanning tools (e.g., Shodan, Censys) or by checking the panel's version information.
2. Craft malicious URL: Construct a login URL with a malicious next_url parameter pointing to an attacker-controlled phishing site, e.g., https://<target>:<port>/login?next_url=https://evil.com.
3. Distribute the link: Send the crafted URL to target users via phishing email, social media, or other social engineering channels, presenting it as a legitimate login link to the Blitz Panel.
4. Victim authenticates: The victim clicks the link and enters their credentials on the legitimate Blitz Panel login page, completing normal authentication.
5. Redirect and harvest: Upon successful login, the application redirects the victim to the attacker's domain. The attacker can then present a fake page to harvest credentials, capture session tokens leaked via Referer headers, or deliver malware (GitHub Gist).

• Network: HTTP GET/POST requests to /login endpoint containing a next_url parameter with an external or unexpected domain (e.g., next_url=https:// pointing to non-local hosts); outbound redirects (HTTP 302) from the Blitz Panel server to external domains immediately following successful authentication.
• Logs: Web server or application access logs showing login requests with next_url values containing external URLs (e.g., next_url=https://evil.com); repeated login attempts with varying external redirect targets from the same source IP.
• User Reports: Users reporting unexpected redirects to unfamiliar websites after logging into the Blitz Panel.

The vulnerability is fixed in Blitz Panel version 1.18.1, released by ReturnFI. Administrators should upgrade to v1.18.1 or later immediately by following the project's upgrade instructions. As a temporary workaround prior to patching, network-level controls (e.g., WAF rules) can be configured to block or sanitize requests containing external URLs in the next_url parameter. Users should be advised to verify the URL in their browser's address bar after logging in and to report unexpected redirects (GitHub Gist, Blitz GitHub).

The vulnerability was acknowledged and confirmed by the Blitz Panel project maintainer on August 30, 2025, and a patch was released in v1.18.1. A technical write-up was published by Infinit Security (Infinit Security). No significant broader media coverage or notable researcher commentary beyond the discoverer's disclosure has been identified.