CVE-2026-40332: 
MasaCMS vulnerability analysis and mitigation

CVE-2026-40332 is an Open Redirect vulnerability in Masa CMS caused by improper handling of scheme-relative URLs (double-slash paths). The application incorrectly treats paths beginning with // as internal paths without validating whether the redirect target remains on the local site, allowing attackers to redirect victims to external, attacker-controlled domains. Affected versions span all Masa CMS releases up to and including 7.5.2, across the 7.2.x, 7.3.x, 7.4.x, and 7.5.x branches. The vulnerability was published on May 6, 2026, with the GitHub Security Advisory (GHSA-xw99-h3mw-wj47) originally published April 30, 2026. It carries a CVSS v4.0 base score of 5.3 (Medium) (GitHub Advisory, Red Hat CVE).

The root cause is classified as CWE-601 (URL Redirection to Untrusted Site / 'Open Redirect'). Masa CMS fails to validate redirect target parameters when the supplied value begins with // (double slash), a scheme-relative URL syntax that browsers interpret as an absolute URL (e.g., //evil.com/path). The application's routing logic — particularly when forceDirectoryStructure is enabled — misidentifies these values as internal directory paths and processes the redirect without confirming the destination is local. An attacker crafts a URL such as http://[target-site]:8080//evil.com/test on the trusted Masa CMS domain; when a victim clicks it, they are silently redirected to the attacker's site. No authentication or special privileges are required, though user interaction (clicking the crafted link) is necessary (GitHub Advisory).

Successful exploitation enables phishing attacks by leveraging the trusted Masa CMS domain as a mask to redirect victims to credential-harvesting pages. In authentication flows such as OAuth, the redirect can be chained to leak sensitive tokens or session data to an external domain. Additionally, the vulnerability can bypass URL validation in security headers and email filters that trust the primary domain, and erodes user trust by silently transitioning users to external content (GitHub Advisory).

No public exploit code or active in-the-wild exploitation has been reported for CVE-2026-40332 as of the available data. The EPSS score is approximately 0.063%, indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been identified (Red Hat CVE, GitHub Advisory).

1. Reconnaissance: Identify publicly accessible Masa CMS instances running versions prior to 7.2.10, 7.3.15, 7.4.10, or 7.5.3 using search engines, Shodan, or Censys.
2. Craft malicious URL: Construct a redirect URL using the trusted Masa CMS domain with a double-slash scheme-relative path pointing to an attacker-controlled site, e.g., http://[target-site]:8080//attacker.com/phishing-page.
3. Deliver to victim: Distribute the crafted URL via phishing email, social media, or other channels. Because the URL begins with the legitimate Masa CMS domain, it bypasses email filters and appears trustworthy.
4. Victim clicks link: The victim's browser sends the request to the Masa CMS server, which processes the //attacker.com/phishing-page path as an internal redirect without validation.
5. Redirect executed: The server issues an HTTP redirect response pointing to //attacker.com/phishing-page, and the victim's browser navigates to the attacker-controlled site.
6. Credential/token harvesting: The attacker collects credentials entered on the phishing page, or — in OAuth flows — captures tokens passed as URL parameters to the redirect destination (GitHub Advisory).

• Network: HTTP requests to Masa CMS endpoints containing redirect parameters with values beginning with // (e.g., url=//evil.com, redirect=//attacker.com); HTTP 3xx redirect responses from the Masa CMS server pointing to external domains.
• Logs: Web server or application access logs showing requests with query parameters or path segments containing //[external-domain]; example pattern: GET //<external-host>/path HTTP/1.1 or ?url=//evil.com in request logs.
• Network: Outbound redirect traffic from the Masa CMS server to unexpected external domains, particularly following authentication-related endpoints.
• Logs: Repeated requests from varied source IPs to the same crafted redirect URL pattern, potentially indicating a phishing campaign in progress (GitHub Advisory).

Masa CMS has released patched versions that implement strict validation of redirect targets to prevent resolution to external scheme-relative paths. Users should upgrade immediately to: 7.2.10, 7.3.15, 7.4.10, or 7.5.3 depending on their branch. If an immediate upgrade is not feasible, the following workarounds are recommended: (1) Set forceDirectoryStructure to false in the Masa CMS configuration to prevent incorrect parsing of double-slash paths; (2) implement a custom input filter or WAF rule to reject or rewrite redirect parameters beginning with // or /\; (3) educate users to verify the final destination URL in their browser before entering credentials (GitHub Advisory).

The vulnerability was credited to researchers danhle5402 (reporter) and ntkien002 (finder), and the advisory was published by Masa CMS maintainer guustnieuwenhuis on GitHub. Coverage has been limited to vulnerability aggregator sites and security databases, with no notable broader media coverage or significant social media discussion identified at this time (GitHub Advisory, InfinitSec).