CVE-2026-28413: 
Python vulnerability analysis and mitigation

CVE-2026-28413 is an open redirect vulnerability in Plone's Products.isurlinportal package, where a crafted login URL using more than two forward slashes (e.g., /login?came_from=////evil.example) can bypass domain validation and redirect authenticated users to an external, attacker-controlled website. It affects Products.isurlinportal versions below 2.1.0, versions 3.0.0–3.1.0 (exclusive), and version 4.0.0a1; standard Plone installations are not affected unless the login flow has been customized via add-ons. The vulnerability was discovered during a penetration test by the CERT-EU Team and published on March 2, 2026 (GitHub Advisory). It carries a CVSS v3.1 base score of 5.3–6.1 (Medium/Moderate), depending on the scoring source (GitHub Advisory).

The root cause is improper validation of the came_from URL parameter in the Products.isurlinportal package (CWE-601: URL Redirection to Untrusted Site). Plone's login mechanism redirects users to the URL specified in came_from after successful authentication, and while the package performs domain checks to restrict redirects to trusted sites, a loophole exists when the URL is prefixed with more than two forward slashes (e.g., ////evil.example). This multi-slash prefix bypasses the existing URL validation logic, causing the browser to interpret the destination as an external host. Exploitation requires no authentication or special privileges, but does require user interaction — specifically, a user must click a crafted link and complete the login process (GitHub Advisory, Plone Advisory).

Successful exploitation allows an attacker to redirect a logged-in Plone user to an arbitrary external website without their knowledge, enabling phishing attacks, credential harvesting, or malware delivery. The confidentiality impact is low (users may be tricked into disclosing credentials to a spoofed site), and there is no direct integrity or availability impact on the Plone server itself. The vulnerability only affects Plone deployments with customized login flows (e.g., via add-ons); standard Plone installations are not impacted (GitHub Advisory).

There is no evidence of active in-the-wild exploitation or public proof-of-concept exploit code as of the time of reporting. The EPSS score is approximately 0.013–0.028%, placing it in a very low percentile for near-term exploitation likelihood (GitHub Advisory). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires user interaction, limiting its practical impact compared to fully unauthenticated, no-interaction vulnerabilities.

1. Reconnaissance: Identify Plone sites using customized login flows or add-ons that modify the authentication process, as standard Plone is not affected.
2. Craft malicious URL: Construct a login URL with the came_from parameter set to an external site using four or more forward slashes, e.g., https://target-plone-site.example/login?came_from=////evil.example.
3. Deliver to victim: Send the crafted URL to a target user via phishing email, social engineering, or embedded link, enticing them to click it.
4. User authenticates: The victim visits the crafted URL and logs into the Plone site normally.
5. Redirect occurs: After successful login, the Plone application's came_from validation is bypassed due to the multi-slash prefix, and the user is silently redirected to evil.example — an attacker-controlled site that may mimic the legitimate Plone portal to harvest credentials or deliver malware (GitHub Advisory, Plone Advisory).

• Network: HTTP requests to the Plone login endpoint containing came_from parameters with three or more consecutive forward slashes followed by an external domain (e.g., came_from=////evil.example); outbound HTTP redirects (301/302) from the Plone server to unexpected external domains post-login.
• Logs: Web server access logs showing GET requests to /login with came_from values containing //// or similar multi-slash patterns; referrer logs showing users arriving at external sites from the Plone login page.
• Application Logs: Plone application logs recording login events immediately followed by redirect responses to non-portal domains.

Upgrade Products.isurlinportal to the patched version corresponding to your Plone release: Plone 6.2 users should upgrade to Products.isurlinportal 4.0.0; Plone 6.1 users to 3.1.0; and Plone 6.0 users to 2.1.0. There are no known configuration-based workarounds — patching is the only remediation. Older Plone versions no longer receive security support and should be upgraded to a supported release (GitHub Advisory, Plone Advisory). Administrators can test exposure by visiting /login?came_from=////evil.example on their instance to verify if a redirect occurs.

The vulnerability was discovered by the CERT-EU Team during a penetration test and responsibly disclosed to the Plone maintainers, who published the advisory on March 2, 2026 (GitHub Advisory). Red Hat acknowledged the CVE in their security tracking (Red Hat). Community reaction has been limited given the moderate severity and narrow impact scope.