CVE-2025-66447: Chamilo LMS Redirect Vulnerability

CVE-2025-66447 Overview

CVE-2025-66447 is an open redirect vulnerability affecting Chamilo LMS, a widely-used learning management system. The vulnerability exists in versions 1.11.0 through 2.0-beta.1 and allows unauthenticated attackers to trigger malicious redirects by manipulating the redirect parameter in the /login endpoint. This type of vulnerability (CWE-601: URL Redirection to Untrusted Site) can be leveraged for phishing attacks, credential theft, and social engineering campaigns targeting users of affected Chamilo LMS installations.

Critical Impact
Unauthenticated attackers can redirect users to malicious websites through the login page, potentially enabling credential harvesting, malware distribution, or social engineering attacks against educational institution users and administrators.

Affected Products

Chamilo LMS versions 1.11.0 through 2.0-beta.1
Chamilo LMS installations with default login page configurations
Educational platforms running vulnerable Chamilo LMS deployments

Discovery Timeline

2026-04-10 - CVE-2025-66447 published to NVD
2026-04-13 - Last updated in NVD database

Technical Details for CVE-2025-66447

Vulnerability Analysis

This vulnerability is classified under CWE-601 (URL Redirection to Untrusted Site), commonly known as an open redirect. The flaw resides in the login functionality of Chamilo LMS, where the application fails to properly validate the redirect parameter before processing redirect requests. When users authenticate or interact with the login page, an attacker-controlled URL can be injected into this parameter, causing the application to redirect users to arbitrary external sites.

Open redirect vulnerabilities are particularly dangerous in educational contexts where users may inherently trust links originating from their institution's learning management system. An attacker could craft a convincing phishing link that appears to originate from a legitimate Chamilo LMS installation but ultimately redirects users to a malicious site designed to harvest credentials or deliver malware.

Root Cause

The root cause of this vulnerability is insufficient input validation and sanitization of the redirect parameter within the /login endpoint. The application does not adequately verify whether the supplied redirect URL points to a trusted destination before performing the redirect operation. This allows attackers to bypass intended navigation flows and direct users to external, potentially malicious domains.

Attack Vector

The attack is network-based and requires no authentication or special privileges. An attacker constructs a malicious URL containing a crafted redirect parameter pointing to an attacker-controlled site. This URL can be distributed via email, social media, or embedded in other web pages. When a victim clicks the link and interacts with the Chamilo LMS login page, they are ultimately redirected to the malicious destination.

The attack typically follows this pattern:

Attacker identifies a Chamilo LMS instance running a vulnerable version
Attacker crafts a URL with the /login endpoint containing a malicious redirect parameter
Victim receives the link through phishing email or other distribution method
Victim clicks the link, perceiving it as legitimate due to the trusted domain
After interaction with the login page, victim is redirected to the attacker's site
Attacker harvests credentials or delivers malicious payload

Detection Methods for CVE-2025-66447

Indicators of Compromise

Unusual redirect parameters in web server logs containing external URLs to the /login endpoint
User reports of unexpected redirects after visiting institutional Chamilo LMS pages
Login page URLs containing suspiciously long or encoded redirect parameter values
Phishing reports referencing legitimate Chamilo LMS domains with malicious redirect payloads

Detection Strategies

Implement web application firewall (WAF) rules to detect and block requests with external URLs in the redirect parameter
Monitor web server access logs for /login requests containing redirect parameters pointing to non-whitelisted domains
Deploy URL analysis tools to inspect outbound redirect destinations from authentication endpoints
Utilize security information and event management (SIEM) correlation rules to identify potential open redirect exploitation patterns

Monitoring Recommendations

Enable detailed logging for all authentication-related endpoints including parameter values
Configure alerts for high volumes of login page requests with varying redirect parameter values
Implement user behavior analytics to detect anomalous redirect patterns following authentication
Regularly audit referrer logs for unexpected external destinations originating from the login workflow

How to Mitigate CVE-2025-66447

Immediate Actions Required

Upgrade Chamilo LMS installations to version 2.0-beta.2 or later immediately
Review web server logs for evidence of exploitation attempts targeting the /login endpoint
Implement URL whitelisting at the application or WAF level to restrict redirect destinations
Notify users about potential phishing attempts leveraging institution-branded Chamilo LMS links

Patch Information

The vulnerability has been addressed in Chamilo LMS version 2.0-beta.2. The fix is available through the official GitHub commit. Organizations should review the GitHub Security Advisory for complete details on the patch and upgrade instructions.

Workarounds

Configure web server or reverse proxy rules to strip or validate the redirect parameter before passing requests to Chamilo LMS
Implement a whitelist of allowed redirect destinations at the network perimeter
Temporarily disable redirect functionality on the login page if operationally feasible
Deploy Content Security Policy (CSP) headers with strict navigate-to directives to limit redirect destinations

bash

# Example Apache configuration to restrict redirect parameter
# Add to .htaccess or virtual host configuration
RewriteEngine On
RewriteCond %{QUERY_STRING} redirect=.*https?:// [NC]
RewriteRule ^login(.*)$ /login [R=302,L,QSD]