CVE-2025-60935: Returnfi Blitz Open Redirect Vulnerability

CVE-2025-60935 is an open redirect flaw in Returnfi Blitz Panel v1.17.0 affecting the login endpoint's next_url parameter. Attackers can redirect users to malicious domains for phishing or token theft. This article covers technical details, affected versions, impact assessment, and mitigation strategies.

CVE-2025-60935 Overview

CVE-2025-60935 is an open redirect vulnerability in the login endpoint of Blitz Panel v1.17.0 developed by ReturnFi. The next_url parameter accepts attacker-controlled URLs without validation. Attackers can craft login links that redirect authenticated users to malicious external domains. This behavior enables phishing attacks and post-authentication token theft. The flaw is classified under CWE-601 (URL Redirection to Untrusted Site).

Critical Impact
Attackers can redirect authenticated Blitz Panel users to attacker-controlled domains, facilitating credential harvesting and session token theft through phishing pages that mimic the legitimate application.

Affected Products

ReturnFi Blitz Panel v1.17.0
CPE: cpe:2.3:a:returnfi:blitz:1.17.0
Login endpoint using the next_url parameter

Discovery Timeline

2025-12-24 - CVE-2025-60935 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-60935

Vulnerability Analysis

The vulnerability resides in the Blitz Panel login endpoint, which accepts a next_url query parameter used to redirect users after successful authentication. The application fails to validate whether the supplied URL points to a trusted internal destination. An attacker supplies an absolute URL pointing to an external domain, and the server issues a redirect to that domain once authentication completes.

The attack requires user interaction, since the victim must click a crafted login link. The redirect occurs in the context of the browser session, so any authentication tokens or session cookies exposed by post-login mechanisms may leak to the attacker-controlled site. This is a scope-changing weakness because the impact extends beyond the vulnerable component into the user's browser trust boundary.

Root Cause

The root cause is missing validation of the next_url parameter against an allowlist of trusted destinations. The application treats user-supplied redirect targets as safe without verifying the scheme, host, or path. This pattern maps directly to CWE-601, where untrusted input controls a redirection target.

Attack Vector

An attacker crafts a phishing URL of the form https://blitz-panel.example/login?next_url=https://attacker.tld/fake-login. The victim receives the link through email, chat, or a compromised page. After the victim authenticates against the legitimate Blitz Panel, the server redirects the browser to the attacker's domain. The attacker's page can mimic the panel interface to capture credentials, prompt for tokens, or exploit any session material transmitted during the redirect.

See the proof-of-concept and the Blitz project repository for additional technical context.

Detection Methods for CVE-2025-60935

Indicators of Compromise

Login requests to Blitz Panel containing a next_url parameter with an absolute URL pointing to an external host.
HTTP 302 responses from the login endpoint with a Location header referencing an untrusted domain.
Referer headers on outbound web traffic showing the Blitz Panel login URL followed by navigation to unfamiliar domains.

Detection Strategies

Parse web server or reverse proxy logs for next_url values and flag any that resolve to hosts outside the organization's allowed domain list.
Deploy a web application firewall (WAF) rule that inspects redirect parameters on /login and blocks values containing external schemes or hostnames.
Correlate authenticated login events with immediately following outbound requests to newly observed domains.

Monitoring Recommendations

Alert on anomalous phishing patterns targeting Blitz Panel users, including lookalike domains and suspicious inbound links referencing the login endpoint.
Monitor DNS and proxy logs for domains typosquatting the legitimate Blitz Panel hostname.
Track user reports of unexpected redirects or credential prompts after logging into the panel.

How to Mitigate CVE-2025-60935

Immediate Actions Required

Restrict access to the Blitz Panel login endpoint at the network edge until a patched version is deployed.
Instruct users to access the panel only through bookmarked URLs, not through emailed or messaged links.
Deploy a WAF rule that strips or rejects next_url parameters containing absolute URLs on the /login endpoint.

Patch Information

No vendor advisory or fixed version is listed in the CVE data at the time of publication. Monitor the ReturnFi Blitz repository for security updates beyond v1.17.0 and apply them once available.

Workarounds

Enforce server-side validation that limits next_url to relative paths beginning with / and rejects any value containing a scheme or host component.
Implement an allowlist of permitted post-login redirect targets and reject any value outside that list.
Set the Referrer-Policy header to strict-origin-when-cross-origin to limit information leakage during unintended redirects.

bash

# Example NGINX rule to block external next_url values on the login endpoint
location /login {
    if ($arg_next_url ~* "^(https?:)?//") {
        return 400;
    }
    proxy_pass http://blitz_backend;
}