CVE-2026-39985: LORIS Open Redirect Vulnerability

CVE-2026-39985 Overview

CVE-2026-39985 is an open redirect vulnerability (CWE-601) affecting LORIS (Longitudinal Online Research and Imaging System), a self-hosted web application designed for data and project management in neuroimaging research environments. The vulnerability exists in the login redirect parameter, which fails to validate that the redirect target is within the LORIS application domain. This allows attackers to craft malicious links that redirect authenticated users to arbitrary external URLs after login.

Critical Impact

Attackers can leverage this open redirect vulnerability to conduct phishing attacks by tricking users into visiting malicious third-party websites after successfully authenticating to LORIS, potentially leading to credential theft or malware distribution.

Affected Products

• LORIS versions prior to 27.0.3
• LORIS versions prior to 28.0.1

Discovery Timeline

• 2026-04-09 - CVE CVE-2026-39985 published to NVD
• 2026-04-09 - Last updated in NVD database

Technical Details for CVE-2026-39985

Vulnerability Analysis

This open redirect vulnerability (CWE-601) occurs in the LORIS login authentication flow. When users log in to LORIS, the application accepts a redirect parameter that specifies where to navigate after successful authentication. Prior to the patch, this redirect parameter was processed without validating whether the destination URL belonged to the same origin as the LORIS application. This means an attacker could craft a malicious login URL containing a redirect to an external malicious site, and after the user successfully authenticates, they would be automatically redirected to the attacker-controlled destination.

The attack is network-accessible and requires user interaction—specifically, the victim must click on the crafted malicious link and complete the login process. While this vulnerability primarily enables information disclosure through social engineering attacks, the impact includes potential credential harvesting through convincing phishing pages that appear to be part of the legitimate authentication flow.

Root Cause

The root cause is insufficient input validation on the redirect parameter in the loginIndex.js module. The original implementation directly used the redirect parameter value without verifying that the destination URL shared the same origin as the LORIS application. This allowed arbitrary URLs to be used as redirect targets, enabling open redirect attacks.

Attack Vector

An attacker exploits this vulnerability by constructing a malicious URL to the LORIS login page with a specially crafted redirect parameter pointing to an external domain. The attack flow is as follows:

1. Attacker creates a URL like https://legitimate-loris.example.com/login?redirect=https://malicious-site.com/phishing
2. Attacker distributes this link via email, social media, or other channels to potential victims
3. Victim clicks the link and is presented with the legitimate LORIS login page
4. After successful authentication, the victim is automatically redirected to the attacker's malicious site
5. The malicious site may impersonate LORIS or other trusted services to harvest credentials or deliver malware

         if (response.ok) {
           response.json().then(() => {
             // Redirect if there is a "redirect" param, refresh the page otherwise
-            window.location.href = this.props.redirect !== null
-              ? this.props.redirect
-              : window.location.origin;
+            const redirectUrl = this.props.redirect;
+            if (redirectUrl) {
+              // test URL as string
+              if (typeof redirectUrl !== 'string') {
+                window.location.href = window.location.origin;
+              };
+
+              // parse URL
+              try {
+                // relative and absolute url parsing
+                const url = new URL(redirectUrl.trim(), window.location.origin);
+
+                if (url.origin === window.location.origin) {
+                  // same origin, load
+                  window.location.href = url.href;
+                } else {
+                  // different origin
+                  // TODO: add a sweet alert here to mention the tentative of
+                  // redirection outside of LORIS.
+                  window.location.href = window.location.origin;
+                }
+              } catch (e) {
+                // Invalid URL, fallback
+                window.location.href = window.location.origin;

Source: GitHub Commit Update

Detection Methods for CVE-2026-39985

Indicators of Compromise

• Login requests containing redirect parameters with external domains or unusual URL patterns
• User authentication logs showing successful logins followed by immediate navigation to external sites
• Network traffic showing outbound connections to suspicious domains immediately after LORIS authentication
• Phishing reports from users who received links to the LORIS login page with suspicious redirect parameters

Detection Strategies

• Implement web application firewall (WAF) rules to detect and block login requests containing redirect parameters pointing to external domains
• Monitor authentication logs for patterns of redirect parameter abuse, particularly requests with external URLs
• Deploy URL analysis to identify login links being distributed via phishing campaigns that contain open redirect payloads
• Review server access logs for login endpoint requests with redirect parameters containing non-local hostnames

Monitoring Recommendations

• Enable detailed logging for the LORIS login endpoint, including all query parameters
• Set up alerts for authentication requests containing redirect parameters with external domain references
• Monitor user-reported phishing attempts that leverage LORIS login URLs
• Implement anomaly detection for unusual redirect patterns following successful authentications

How to Mitigate CVE-2026-39985

Immediate Actions Required

• Upgrade LORIS to version 27.0.3 or 28.0.1 immediately to address the open redirect vulnerability
• Review authentication logs for any signs of exploitation attempts using malicious redirect parameters
• Alert users about potential phishing attacks that may leverage this vulnerability with crafted login links
• Implement URL validation at the WAF level as an additional defense layer while patching

Patch Information

The vulnerability has been fixed in LORIS versions 27.0.3 and 28.0.1. The patch implements proper origin validation for the redirect parameter, ensuring that redirects only occur to URLs within the same origin as the LORIS application. For technical details, see the GitHub Security Advisory GHSA-rch2-f5fw-cg95.

Patched releases are available:

• GitHub Release v27.0.3
• GitHub Release v28.0.1

Workarounds

• Deploy a web application firewall rule to block or sanitize redirect parameters in login requests pointing to external domains
• Implement server-side validation of the redirect parameter at the reverse proxy level to reject requests with external URLs
• Educate users to verify URLs before clicking login links and to only access LORIS directly through bookmarks
• Consider disabling the redirect functionality temporarily by modifying the login handler to ignore the redirect parameter

# Example nginx configuration to block external redirects
location /login {
    # Block requests with external redirect parameters
    if ($arg_redirect ~* "^https?://(?!your-loris-domain\.com)") {
        return 403;
    }
    proxy_pass http://loris_backend;
}