CVE-2026-18721: KodBox SSO API Open Redirect Vulnerability

CVE-2026-18721 Overview

CVE-2026-18721 is an open redirect vulnerability in kalcaddle kodbox version 1.67 Build 02. The flaw resides in the /user/sso/apiLogin endpoint of the SSO API Login component. Attackers can manipulate the callbackUrl argument to redirect authenticated users to attacker-controlled destinations. The vulnerability is categorized under [CWE-601] (URL Redirection to Untrusted Site). The exploit has been publicly disclosed, and the vendor did not respond to early disclosure attempts. The issue can be triggered remotely without prior authentication, though user interaction is required to complete the redirect.

Critical Impact
Remote attackers can craft URLs that abuse the kodbox SSO login flow to redirect victims to phishing or malware-hosting sites while appearing to originate from a trusted domain.

Affected Products

kalcaddle kodbox 1.67 Build 02
SSO API Login component (/user/sso/apiLogin)
Deployments exposing the callbackUrl parameter to untrusted input

Discovery Timeline

2026-08-04 - CVE-2026-18721 published to NVD
2026-08-04 - Last updated in NVD database

Technical Details for CVE-2026-18721

Vulnerability Analysis

The vulnerability affects the SSO API Login handler in kodbox 1.67 Build 02. When a request reaches /user/sso/apiLogin, the application accepts a callbackUrl argument that determines where the user is sent after authentication. The handler does not validate that the destination points to a trusted host or path.

An attacker can supply an arbitrary external URL through callbackUrl. When a victim follows the crafted link, the kodbox instance issues a redirect to the attacker-supplied destination. Because the initial URL references a legitimate kodbox host, the request bypasses casual link inspection by end users.

The root weakness is classified as [CWE-601], URL Redirection to Untrusted Site (Open Redirect). Impact is confined to integrity of user navigation. Confidentiality and availability of the kodbox application are not directly affected, but the flaw is a strong primitive for phishing and credential theft campaigns that leverage the trust of the kodbox domain.

Root Cause

The root cause is missing allowlist validation of the callbackUrl parameter in the SSO API Login flow. The application treats user-supplied URL input as a trusted post-login destination without confirming the scheme, host, or origin match an approved set.

Attack Vector

Exploitation is remote and requires user interaction. An attacker distributes a crafted link of the form https://<kodbox-host>/user/sso/apiLogin?callbackUrl=https://attacker.example. When the victim clicks the link and the SSO flow completes, kodbox redirects the browser to the attacker-controlled site. The destination can host a cloned login page to harvest credentials, deliver malicious downloads, or chain into browser exploitation.

No code examples are published from a verified source. Refer to the GitHub Issue Discussion and the VulDB CVE-2026-18721 record for reproduction details.

Detection Methods for CVE-2026-18721

Indicators of Compromise

Web server access logs containing requests to /user/sso/apiLogin with a callbackUrl parameter pointing to an external or unexpected domain.
HTTP 3xx responses from kodbox where the Location header targets hosts outside the organization's approved domain list.
Referer chains showing users arriving at unknown external sites immediately after a kodbox SSO login request.

Detection Strategies

Parse web proxy and WAF logs for callbackUrl values that fail an allowlist check against approved return URLs.
Alert on anomalous outbound redirects from kodbox hosts to newly registered or low-reputation domains.
Correlate SSO login events with subsequent credential submissions to unfamiliar external forms to identify phishing follow-through.

Monitoring Recommendations

Enable verbose logging of full query strings on the /user/sso/apiLogin endpoint.
Feed kodbox access logs into a SIEM and build dashboards that break down callbackUrl destinations by domain reputation.
Track user-reported phishing incidents that reference the kodbox domain in the sender or link chain.

How to Mitigate CVE-2026-18721

Immediate Actions Required

Restrict external network exposure of kodbox /user/sso/apiLogin where feasible until a vendor patch is available.
Deploy a WAF rule that rejects requests to /user/sso/apiLogin when callbackUrl points to a host outside a defined allowlist.
Warn users through internal channels about phishing links that abuse kodbox SSO URLs.

Patch Information

No vendor patch has been published in the referenced advisories. The VulDB record notes the vendor was contacted early and did not respond. Track the VulDB Vulnerability Record and the GitHub Issue Discussion for updates on a fixed release of kodbox after 1.67 Build 02.

Workarounds

Implement a reverse-proxy filter that validates the callbackUrl parameter against a strict allowlist of internal hostnames and paths.
Enforce that callbackUrl values use a relative path and reject absolute URLs at the proxy layer.
Add browser-level phishing protection and user awareness training to reduce the impact of successful redirects.

bash

# Example NGINX snippet to block external callbackUrl values on the SSO endpoint
location = /user/sso/apiLogin {
    if ($arg_callbackUrl ~* "^https?://(?!kodbox\.internal\.example\.com)") {
        return 400;
    }
    proxy_pass http://kodbox_upstream;
}