CVE-2026-78145: CTFd Open Redirect Vulnerability

CVE-2026-78145 Overview

CVE-2026-78145 is an open redirect vulnerability [CWE-601] in CTFd, an open-source Capture The Flag platform. The flaw affects versions up to and including 3.8.4 and resides in the _is_safe_url function located in CTFd/utils/validators/__init__.py. Attackers can manipulate the next parameter to redirect users to attacker-controlled URLs after authentication flows. The exploit has been publicly disclosed. The maintainers addressed the issue in commit 5d8515842fd1ab2c3a9f2dde9ffca907aa334ea9, shipped with release 3.8.4.

Critical Impact
Attackers can craft URLs that pass CTFd's URL safety validation and redirect authenticated users to external phishing or malware-hosting domains, enabling credential theft and social engineering.

Affected Products

CTFd versions up to and including 3.8.4
Deployments exposing authentication endpoints that honor the next query parameter
Self-hosted CTFd instances used for CTF competitions and training platforms

Discovery Timeline

2026-08-23 - CVE-2026-78145 published to NVD
2026-08-24 - Last updated in NVD database

Technical Details for CVE-2026-78145

Vulnerability Analysis

The vulnerability originates in CTFd's URL validation logic. The _is_safe_url helper in CTFd/utils/validators/__init__.py is invoked during login and other authentication redirects to confirm that user-supplied redirect targets belong to the same host as the application. The check does not fully normalize the supplied URL, allowing crafted input in the next parameter to bypass the same-origin comparison. Because the flaw is a redirection issue and not a code execution flaw, the confidentiality and availability impact is limited, but the integrity impact enables convincing phishing pages hosted under the legitimate CTFd domain in the initial request. The EPSS score is 0.42% with a percentile of 34.875, indicating a low predicted probability of exploitation activity in the near term.

Root Cause

The root cause is improper validation of a URL supplied by an untrusted actor [CWE-601]. _is_safe_url compares components of a parsed URL to determine whether the destination is internal. Edge cases in the parsing logic accept crafted values that resolve to external hosts once the browser follows the redirect. The patch tightens this validation and is bundled into the version bump from 3.8.3 to 3.8.4.

Attack Vector

An attacker crafts a link to a CTFd endpoint that consumes the next parameter, for example a login URL. The victim clicks the link, authenticates against the legitimate CTFd instance, and the application then redirects the browser to the attacker-controlled destination supplied through next. The attacker's page can mimic CTFd to harvest credentials, session tokens, or one-time codes. Exploitation requires user interaction but no privileges on the target instance.

python

# Patch reference: version bump accompanying the fix
 from CTFd.utils.updates import update_check
 from CTFd.utils.user import get_locale

-__version__ = "3.8.3"
+__version__ = "3.8.4"
 __channel__ = "oss"

Source: CTFd Commit 5d851584

Detection Methods for CVE-2026-78145

Indicators of Compromise

Requests to CTFd authentication endpoints containing a next parameter that references an external domain or protocol-relative URL such as //evil.example.
Outbound HTTP referrers from user browsers originating at the CTFd login page but landing on unrelated domains.
Repeated user reports of unexpected redirects immediately after logging into CTFd.

Detection Strategies

Inspect web server and reverse proxy logs for next= values that URL-decode to hosts outside the CTFd deployment.
Deploy Web Application Firewall rules that reject next parameters not matching an allow-list of internal paths.
Correlate authentication events with subsequent 3xx redirects issued by CTFd to identify anomalous redirect targets.

Monitoring Recommendations

Alert on phishing pages that impersonate the CTFd deployment brand hosted on newly registered domains.
Monitor referrer headers on downstream services for unexpected chains originating from CTFd login endpoints.
Track CTFd version strings across environments to confirm all instances run 3.8.4 or later.

How to Mitigate CVE-2026-78145

Immediate Actions Required

Upgrade CTFd to version 3.8.4 or later, which includes commit 5d8515842fd1ab2c3a9f2dde9ffca907aa334ea9.
Audit existing CTFd deployments for the vulnerable _is_safe_url implementation in CTFd/utils/validators/__init__.py.
Notify users of the deployment about the phishing risk and reinforce guidance to verify destination URLs after login.

Patch Information

The fix is delivered in CTFd release 3.8.4. Review the CTFd Pull Request #3026, the CTFd Commit Update, and the CTFd Release 3.8.4 for full change details. Additional analysis is available in the CTFd Open Redirect Writeup and the VulDB entry for CVE-2026-78145.

Workarounds

Configure the upstream reverse proxy to strip or validate the next query parameter before it reaches CTFd.
Restrict access to CTFd authentication endpoints via network controls where feasible during patch rollout.
Add a Content Security Policy and user education banner to reduce the impact of unexpected redirects.

bash

# Example nginx rule to drop external next= redirects until patched
location /login {
    if ($arg_next ~* "^(https?:)?//") {
        return 400;
    }
    proxy_pass http://ctfd_upstream;
}