CVE-2026-45566: 
Roxy-WI vulnerability analysis and mitigation

CVE-2026-45566 is an open redirect vulnerability in Roxy-WI, a web interface for managing HAProxy, Nginx, Apache, and Keepalived servers. The flaw exists in versions 8.2.6.4 and prior, where the login flow's URL allow-list check can be bypassed using the RFC 3986 userinfo (@host) syntax, causing authenticated users to be silently redirected to attacker-controlled sites. It was published on June 10, 2026, with the GitHub Security Advisory (GHSA-xw9x-68gg-mp5h) originally published May 15, 2026. It carries a CVSS v3.1 base score of 6.1 (Medium) (GitHub Advisory). As of publication, no patches are available (GitHub Advisory).

The root cause is CWE-601 (URL Redirection to Untrusted Site / Open Redirect). In app/modules/roxywi/auth.py (lines 101–113), the do_login() function rejects next_url values containing the substrings https:// or http://, then constructs the redirect as https://{request.host}{next_url}. However, the check does not account for the RFC 3986 userinfo syntax: a next parameter value of @evil.example/path bypasses the filter and produces https://victim.example@evil.example/path. All modern browsers parse this URL with evil.example as the authority and victim.example as the userinfo credential, routing the request to the attacker's domain. The JavaScript client in app/static/js/script.js (lines 587–621) then executes window.location.replace(data.next_url), completing the redirect without any further validation (GitHub Advisory).

After a legitimate login, the victim is silently navigated to an attacker-controlled site, enabling phishing and credential harvesting — the user may believe they are still interacting with the Roxy-WI interface and submit sensitive credentials or session tokens to the attacker. The confidentiality and integrity impacts are low in scope but meaningful given the post-authentication context, as the attacker can mimic the Roxy-WI UI to harvest secrets. Availability is not impacted, and there is no direct path to lateral movement or remote code execution through this vulnerability alone (GitHub Advisory).

1. Craft the malicious URL: Construct a login URL targeting the victim's Roxy-WI instance with a crafted next parameter, e.g., http://victim.example/login?next=@evil.example/login. The @evil.example/login value bypasses the https:///http:// substring check.
2. Deliver the link: Send the crafted URL to the target user via phishing email, social engineering, or any other delivery mechanism that causes the victim to click the link.
3. Victim authenticates: The victim visits the crafted URL and logs in normally with their Roxy-WI credentials. The server-side do_login() function constructs redirect_to = f'https://{request.host}@evil.example/login'.
4. Redirect executes: The server returns {"status": "done", "next_url": "https://victim.example@evil.example/login"}. The JavaScript client calls window.location.replace(data.next_url).
5. Browser routes to attacker site: The browser parses victim.example as RFC 3986 userinfo and evil.example as the host, navigating the victim to the attacker-controlled site.
6. Credential harvest: The attacker's site mimics the Roxy-WI interface, prompting the victim to re-enter credentials or capturing session tokens, completing the phishing attack (GitHub Advisory).

• Network: HTTP POST requests to /login with a next parameter value beginning with @ (e.g., next=@evil.example/path) in the JSON body or query string.
• Logs: Web server access logs showing POST requests to /login where the next field contains @ followed by an external domain; JSON response bodies containing next_url values with the pattern https://<host>@<external-domain>/.
• Logs: Application logs from app/modules/roxywi/auth.py where redirect_to is constructed with a userinfo-style URL (containing @ before the host portion of the destination).

As of the time of publication, no official patch has been released for Roxy-WI versions 8.2.6.4 and prior (GitHub Advisory). The advisory recommends replacing the current next_url validation logic in app/modules/roxywi/auth.py with a proper URL parser-based check using Python's urllib.parse.urlparse, rejecting any next_url that contains a scheme, netloc, starts with //, or starts with /\. Administrators should monitor the Roxy-WI GitHub repository for a patched release and apply it immediately upon availability. As an interim measure, consider restricting access to the Roxy-WI login page to trusted networks only, reducing the attack surface for phishing-based exploitation.

The vulnerability was credited to researchers Vishal Shukla (@shukla304) and the Sechub.dev AI Agent, and was published by the Roxy-WI maintainer (Aidaho12) via GitHub's security advisory process (GitHub Advisory). No significant broader media coverage or notable community commentary beyond the advisory itself has been identified at this time.