CVE-2026-21879: 
NixOS vulnerability analysis and mitigation

CVE-2026-21879 is an Open Redirect vulnerability (CWE-601) in Kanboard, a Kanban-based project management application. Versions 1.2.48 and below are affected; the issue was discovered on December 30, 2025, and publicly disclosed on January 7–8, 2026. An attacker can craft protocol-relative URLs (e.g., //evil.com) to bypass PHP's filter_var() validation and redirect authenticated users to attacker-controlled websites after login. The vulnerability carries a CVSS v3.1 base score of 6.1 (Medium) (GitHub Advisory, Feedly).

The root cause is improper URL validation (CWE-601) in app/Controller/BaseController.php. When an unauthenticated user accesses a protected resource, AuthenticationMiddleware.php stores the full request URI — including attacker-supplied protocol-relative paths like //evil.com/phishing — in the session without sanitization. After successful login, redirectAfterLogin() checks the stored URL using filter_var($url, FILTER_VALIDATE_URL), which returns false for protocol-relative URLs; the inverted condition (! filter_var(...)) then treats this as a safe relative path and issues the redirect. The fix, introduced in commit 93bcae0, adds a new isSafeRedirectUri() method that explicitly rejects URIs starting with //, containing backslashes, or containing a scheme/host component, and also validates the URI before storing it in the session (GitHub Advisory, Patch Commit).

Successful exploitation allows attackers to redirect authenticated Kanboard users to arbitrary external websites after login, enabling phishing campaigns, credential harvesting via fake login pages, and malware distribution. Because the redirect occurs immediately after the victim authenticates against a legitimate Kanboard domain, users are unlikely to suspect the redirect. There is no direct impact on availability or server-side data integrity, but confidentiality is at low risk due to potential credential theft on attacker-controlled sites (GitHub Advisory).

A working proof-of-concept exploit script (Python) and detailed curl-based reproduction steps are publicly available in the GitHub Security Advisory. No authentication is required to craft and deliver the malicious link; only user interaction (clicking the link and logging in) is needed. The vulnerability is not listed in the CISA KEV catalog, and the EPSS score is approximately 0.028% (very low probability of automated exploitation in the near term). No threat actor attribution or in-the-wild exploitation has been reported (GitHub Advisory, Feedly).

1. Reconnaissance: Identify internet-facing Kanboard instances running version 1.2.48 or earlier using search engines (Shodan, Censys) or by checking the Kanboard version page.
2. Craft malicious URL: Construct a protocol-relative redirect URL targeting the victim's Kanboard instance, e.g., http://kanboard.example.com//evil.com/phishing.
3. Deliver the link: Send the crafted URL to the target user via email, chat, or any social engineering channel, leveraging the trusted Kanboard domain to increase credibility.
4. Victim accesses URL: When the victim clicks the link, Kanboard's AuthenticationMiddleware stores //evil.com/phishing in the session and redirects the user to the legitimate login page.
5. Victim authenticates: The victim sees the real Kanboard login page and enters valid credentials.
6. Open redirect triggered: After successful authentication, redirectAfterLogin() retrieves the stored URI, the flawed filter_var() check passes for the protocol-relative URL, and Kanboard issues a 302 Location: //evil.com/phishing response.
7. Browser follows redirect: The browser interprets //evil.com as http://evil.com and navigates the victim to the attacker-controlled phishing page (GitHub Advisory).

• Network: HTTP requests to the Kanboard instance with a URL path beginning with // (e.g., GET //evil.com/phishing HTTP/1.1); HTTP 302 responses from Kanboard with a Location header starting with // pointing to an external domain.
• Logs: Web server access logs showing requests with double-slash paths such as GET //attacker.com/... HTTP/1.1; application logs recording session storage of protocol-relative URIs in redirectAfterLogin.
• Application Session: Session data containing a redirectAfterLogin value that starts with // or an external hostname rather than a single / followed by an alphanumeric character (GitHub Advisory).

Upgrade Kanboard to version 1.2.49 or later, which introduces the isSafeRedirectUri() method to properly validate redirect URIs before storing or using them (Kanboard Release, Patch Commit). If immediate upgrade is not possible, a temporary workaround is to restrict external access to the Kanboard login endpoint or implement a web application firewall (WAF) rule that blocks requests with double-slash (//) path prefixes. Organizations should also educate users to verify the URL in their browser's address bar after being redirected post-login.

Heise reported on the Kanboard 1.2.49 release in the context of multiple security fixes, noting the authentication-related vulnerabilities patched in that version (Heise). BeyondMachines also covered the release, highlighting the critical authentication bypass and information disclosure fixes alongside this open redirect (BeyondMachines). Community reaction on GitHub was positive, with the reporter (HUSEYNKHANLI) acknowledged in the release notes and several contributors reacting with approval to the v1.2.49 release.