CVE-2026-58450 Overview
CVE-2026-58450 is an open redirect vulnerability [CWE-601] in Invoice Ninja through version 5.13.26. The flaw resides in the client portal login flow, where the intended query parameter is stored in the session without host validation. After a victim completes a legitimate login, the ContactLoginControllerauthenticated() handler emits the stored value verbatim through a bare redirect. Unauthenticated attackers can craft a client login link with an external URL in the intended parameter to redirect authenticated victims to attacker-controlled destinations. This behavior enables convincing phishing campaigns that abuse the trusted Invoice Ninja domain as a launch point.
Critical Impact
Attackers can weaponize legitimate Invoice Ninja client login URLs to redirect authenticated users to phishing pages, facilitating credential theft and follow-on fraud against billing customers.
Affected Products
- Invoice Ninja versions through 5.13.26
- Self-hosted Invoice Ninja deployments exposing the client portal
- Hosted Invoice Ninja instances running affected releases
Discovery Timeline
- 2026-06-30 - CVE-2026-58450 published to NVD
- 2026-07-02 - Last updated in NVD database
Technical Details for CVE-2026-58450
Vulnerability Analysis
Invoice Ninja's client portal supports post-login redirection through an intended query parameter. The application persists this value into the user session during the pre-authentication phase without validating that the target belongs to a permitted host. When the victim submits valid credentials, the ContactLoginControllerauthenticated() handler retrieves the stored intended value and issues an HTTP redirect using it directly. Because no allowlist or same-origin check is enforced, the destination can point to any external URL. The vulnerability is classified under CWE-601: URL Redirection to Untrusted Site.
Root Cause
The root cause is missing host validation on the intended session value before it is passed to the redirect response. The controller treats the parameter as a trusted internal path but never restricts the scheme, host, or origin. This lack of output validation allows arbitrary absolute URLs to flow from an attacker-supplied query string to an authenticated user's browser.
Attack Vector
Exploitation requires user interaction but no authentication on the attacker's side. An attacker distributes a crafted client portal login link that embeds a malicious intended value pointing to an attacker-controlled domain. The victim sees a legitimate Invoice Ninja login page, enters valid credentials, and is then redirected off-site. The destination page can impersonate Invoice Ninja to harvest additional data or deliver malware. Refer to the VulnCheck Security Advisory and GitHub Issue #12039 for reproduction details.
Detection Methods for CVE-2026-58450
Indicators of Compromise
- Client portal login requests containing an intended query parameter whose value is an absolute URL with an external scheme or host.
- HTTP 302 responses from the ContactLoginController login endpoint with Location headers pointing to third-party domains.
- Referrer logs on external systems showing traffic originating from the Invoice Ninja client portal login path.
Detection Strategies
- Inspect web server and application logs for intended= parameter values that begin with http://, https://, or // followed by non-local hostnames.
- Correlate authentication success events with immediate outbound redirects to domains outside the Invoice Ninja deployment.
- Baseline expected post-login destinations for the client portal and alert on deviations.
Monitoring Recommendations
- Deploy a web application firewall rule that flags or blocks intended parameters containing external URLs on client portal endpoints.
- Alert on user reports of unexpected redirects following client portal authentication.
- Monitor phishing feeds and brand-abuse services for lookalike domains referencing Invoice Ninja customer portals.
How to Mitigate CVE-2026-58450
Immediate Actions Required
- Upgrade Invoice Ninja to a release later than 5.13.26 once the maintainers publish a fixed version referenced in GitHub Issue #12039.
- Apply a reverse proxy or WAF rule to strip or reject intended query parameters that contain absolute URLs.
- Notify client portal users about phishing risk and instruct them to inspect the address bar after login.
Patch Information
A vendor fix is tracked in GitHub Issue #12039. Administrators should monitor the Invoice Ninja repository for a release addressing the missing host validation in the ContactLoginControllerauthenticated() handler and upgrade as soon as the patched build is available.
Workarounds
- Enforce a server-side allowlist that permits redirects only to the Invoice Ninja application's own host and paths.
- Sanitize the intended session value to accept only relative URLs beginning with / and rejecting protocol-relative // prefixes.
- Restrict client portal access to known networks where feasible to reduce phishing exposure while awaiting a patch.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
