CVE-2026-45566: Roxy-WI CSRF Vulnerability

CVE-2026-45566 Overview

CVE-2026-45566 is an open redirect vulnerability in Roxy-WI, a web interface for managing Haproxy, Nginx, Apache, and Keepalived servers. The flaw exists in the login flow's next_url allow-list logic in versions 8.2.6.4 and prior. The validation rejects strings containing http:// or https:// substrings but fails to account for the userinfo@host URL syntax. Attackers can craft a next parameter such as @evil.example/path that produces https://victim.example@evil.example/path, which modern browsers route to the attacker-controlled host. At time of publication, no patches are publicly available. The issue is classified under CWE-601: URL Redirection to Untrusted Site.

Critical Impact
Authenticated phishing redirects from a trusted Roxy-WI domain enable credential theft and malware delivery against administrators of HAProxy, Nginx, Apache, and Keepalived infrastructure.

Affected Products

Roxy-WI versions 8.2.6.4 and prior
Roxy-WI login flow next_url parameter handling
JavaScript client-side redirect via window.location.replace()

Discovery Timeline

2026-06-10 - CVE-2026-45566 published to NVD
2026-06-10 - Last updated in NVD database

Technical Details for CVE-2026-45566

Vulnerability Analysis

The vulnerability resides in Roxy-WI's post-login redirect handler. The application accepts a next query parameter intended to return users to their originally requested page after authentication. To prevent open redirects, the server-side allow-list logic inspects the parameter for the substrings http:// and https://, rejecting any value containing them.

The server then concatenates the parameter into a string of the form https://{request.host}{next_url}. The resulting URL is passed to the JavaScript client, which performs the redirect via window.location.replace(). Because the substring check assumes a scheme-prefixed absolute URL is the only bypass, it fails to consider URL parsing semantics defined by RFC 3986.

Root Cause

The root cause is incomplete input validation. The allow-list filter treats http:// and https:// as the sole indicators of an external destination. It ignores the userinfo component of a URL authority, where characters preceding an @ symbol are interpreted as credentials rather than as part of the host. Browsers parse the constructed string https://victim.example@evil.example/path and route the request to evil.example, treating victim.example as a username.

Attack Vector

An attacker crafts a phishing link pointing to the legitimate Roxy-WI host with a malicious next value such as next=@evil.example/path. A victim who clicks the link sees the trusted Roxy-WI domain in the URL bar and authenticates normally. After login, the server constructs https://victim.example@evil.example/path and the client-side JavaScript executes window.location.replace(), sending the authenticated user to evil.example. The attacker-controlled site can then mimic Roxy-WI to harvest credentials or deliver malware. Exploitation requires user interaction, consistent with the UI:R component of the assigned CVSS vector.

No verified proof-of-concept code is available. Refer to the GitHub Security Advisory GHSA-xw9x-68gg-mp5h for technical details.

Detection Methods for CVE-2026-45566

Indicators of Compromise

HTTP requests to Roxy-WI login endpoints containing next= parameter values with @ characters in the authority position
Web server access logs showing login redirects where the next value begins with @ followed by an external domain
Referer headers from Roxy-WI hosts immediately preceding traffic to unfamiliar external domains
User reports of unexpected redirects to look-alike Roxy-WI login pages after authentication

Detection Strategies

Parse Roxy-WI access logs for query strings matching the pattern next=@* or URL-encoded equivalents such as next=%40
Inspect outbound proxy or DNS logs for connections to domains that resemble Roxy-WI hostnames but resolve to external IPs shortly after administrator logins
Implement web application firewall (WAF) rules that reject next parameter values containing @ characters or URL-encoded variants

Monitoring Recommendations

Alert on login redirects where the resulting Location header or client-side redirect target resolves to a host outside the organization's managed domains
Monitor for phishing campaigns referencing Roxy-WI URLs in email gateways and threat intelligence feeds
Audit administrator browser history and endpoint telemetry for anomalous redirects following Roxy-WI authentication events

How to Mitigate CVE-2026-45566

Immediate Actions Required

Restrict network access to Roxy-WI management interfaces using IP allow-lists or VPN-only access until a patch is available
Educate administrators to authenticate to Roxy-WI directly via bookmarked URLs rather than following emailed or chat-delivered links
Deploy WAF rules that block requests containing @ characters or %40 sequences in the next parameter
Review recent authentication logs for suspicious next parameter values and notify potentially affected users

Patch Information

At time of publication, no official patch is available from the Roxy-WI maintainers. Monitor the Roxy-WI GitHub Security Advisory GHSA-xw9x-68gg-mp5h for updates and apply fixes immediately upon release. Upgrade beyond version 8.2.6.4 once a fixed release is published.

Workarounds

Add a reverse proxy rule that strips or rejects next query parameters containing @ or %40 before requests reach Roxy-WI
Configure browser security policies and email security gateways to flag URLs containing userinfo segments pointing to external hosts
Disable or override the post-login redirect feature by forcing all authenticated users to a fixed landing page through proxy rewrite rules

bash

# Example NGINX reverse proxy rule to block userinfo bypass in next parameter
if ($arg_next ~* "(@|%40)") {
    return 400 "Invalid next parameter";
}