CVE-2026-100523 PUBLISHED

Cotonti through 1.0.0 contains an open redirect vulnerability in message.php that base64-decodes the redirect parameter without domain validation. Unauthenticated attackers can craft malicious links with encoded external URLs to redirect users to arbitrary sites via meta refresh tags for phishing attacks.

• Harsh Raj Singhania finder

• https://github.com/Cotonti/Cotonti/issues/1907
• https://github.com/Cotonti/Cotonti/pull/1908
• https://github.com/Cotonti/Cotonti/blob/1.0.0/message.php
• https://github.com/Cotonti/Cotonti/blob/1.0.0/system/common.php
• https://github.com/Cotonti/Cotonti
• VulnCheck Advisory: Cotonti through 1.0.0 Open Redirect via message.php redirect parameter

• URL Redirection to Untrusted Site ('Open Redirect') CWE