CVE-2026-51564: Milk Admin SSRF Vulnerability

CVE-2026-51564 Overview

CVE-2026-51564 is an open redirect vulnerability in Milk Admin versions <=0.9.8. The flaw resides in the redirect parameter handling, which fails to validate destination URLs before issuing HTTP redirects. Remote attackers can craft requests that send authenticated users to arbitrary external URLs. This weakness maps to CWE-601: URL Redirection to Untrusted Site.

Open redirects are commonly weaponized in phishing campaigns because the initial URL originates from a trusted domain. The EPSS probability for exploitation is 0.655% with a percentile of 47.753.

Critical Impact
Attackers can abuse the trusted Milk Admin domain to redirect authenticated users to attacker-controlled sites for credential harvesting or malware delivery.

Affected Products

Milk Admin versions <=0.9.8
Repository: giuliopanda/milk-admin
Affected components: milkadmin/App/Route.php and public_html/index.php

Discovery Timeline

2026-07-27 - CVE-2026-51564 published to NVD
2026-07-28 - Last updated in NVD database

Technical Details for CVE-2026-51564

Vulnerability Analysis

The vulnerability affects the routing logic in Milk Admin, an open-source PHP administration framework. The redirect parameter accepts a user-supplied URL and passes it to the HTTP response handler without validating whether the destination is within an allow-listed set of internal paths or hostnames.

Because the redirect is issued server-side, the browser follows the Location header without user interaction. This makes the trusted Milk Admin origin an effective launchpad for phishing pages that mimic the legitimate application login flow.

The issue requires an authenticated session with elevated privileges based on the attack characteristics, but the target user only needs to click a crafted link. Confidentiality and integrity of the application are unaffected, but availability of the intended workflow is disrupted when victims land on hostile destinations.

Root Cause

The root cause is missing input validation on the redirect query parameter within the routing components milkadmin/App/Route.php and public_html/index.php. The application trusts the caller-supplied value and does not enforce a hostname allow list or restrict redirects to relative paths.

Attack Vector

An attacker crafts a URL pointing to a legitimate Milk Admin endpoint with a malicious redirect value referencing an external domain. The victim, believing they are clicking a trusted link, is silently forwarded to the attacker's site. Proof-of-concept material is published at the CVE-2026-51564 PoC repository.

See the vulnerable routing logic in Route.php and the index.php entry point for technical details.

Detection Methods for CVE-2026-51564

Indicators of Compromise

HTTP requests to Milk Admin endpoints containing a redirect query parameter with a fully qualified external URL
Referer headers on external phishing landing pages pointing back to the Milk Admin host
Spikes in 302 Found responses from Milk Admin instances directing traffic off-domain

Detection Strategies

Inspect web server access logs for redirect= values that begin with http://, https://, //, or contain encoded schemes such as %2F%2F
Enable outbound URL inspection on egress proxies to flag redirects that leave the corporate domain via Milk Admin
Alert on user reports of unexpected external landing pages after clicking internal Milk Admin links

Monitoring Recommendations

Ingest Milk Admin web server logs into a centralized analytics platform and baseline redirect destinations by hostname
Correlate open-redirect requests with subsequent authentication events to detect follow-on credential theft
Track user-agent patterns hitting the redirect parameter to identify automated abuse

How to Mitigate CVE-2026-51564

Immediate Actions Required

Upgrade Milk Admin to a release later than 0.9.8 once a fixed version is published by the maintainer
Restrict the redirect parameter to relative paths using an allow list enforced in milkadmin/App/Route.php
Communicate to users that Milk Admin links containing redirect= should be treated with caution until patched

Patch Information

No vendor patch reference is listed in the NVD entry at time of publication. Monitor the Milk Admin repository for a release addressing the redirect parameter handling. Review the PoC repository to validate any candidate fix.

Workarounds

Deploy a web application firewall (WAF) rule that rejects requests where redirect contains external schemes or protocol-relative URLs
Add server-side validation that resolves the redirect target and rejects any value whose host does not match the Milk Admin canonical hostname
Present an interstitial confirmation page for any off-domain redirect to give users a visible warning

bash

# Example nginx rule to block external redirects via the redirect parameter
if ($arg_redirect ~* "^(https?:)?//") {
    return 400;
}