CVE-2026-78377 Overview
CVE-2026-78377 is an open redirect vulnerability [CWE-601] affecting the Yordam Library Information and Document Automation Program. The flaw allows an attacker to craft URLs that redirect users from the trusted application domain to an attacker-controlled site. The vendor, Yordam Informatics Technology Consulting, Training, and Electronic Systems Industry and Trade Inc., produces library automation software used in academic and public library environments. Attackers can abuse the redirect to conduct phishing campaigns that leverage the trusted domain to bypass user suspicion.
Critical Impact
Attackers can weaponize the trusted application URL to redirect authenticated users to malicious sites for credential harvesting and malware delivery.
Affected Products
- Yordam Library Information and Document Automation Program v22.1
- All versions from v22.1 before v22.2
- Deployments exposed to untrusted network traffic
Discovery Timeline
- 2026-09-09 - CVE-2026-78377 published to the National Vulnerability Database (NVD)
- 2026-09-09 - Last updated in NVD database
- 2026-09-09 - Turkish National Cyber Incident Response Center (USOM) issued advisory TR-26-1036
Technical Details for CVE-2026-78377
Vulnerability Analysis
The vulnerability resides in the URL handling logic of the Library Information and Document Automation Program. The application accepts a user-supplied destination parameter and issues an HTTP redirect without validating whether the target belongs to an allowed domain list. Attackers can therefore construct links that begin with the legitimate application hostname but terminate at an arbitrary external location.
Exploitation requires user interaction, typically by clicking a crafted link delivered through email, chat, or a compromised page. Because the initial hostname belongs to the trusted library platform, common phishing indicators such as suspicious domains are hidden until after the redirect completes. The scope change indicates the impact extends beyond the vulnerable component into the user's browser context.
Root Cause
The root cause is missing or insufficient validation of a redirect target parameter, classified under [CWE-601] URL Redirection to Untrusted Site. The application trusts client-supplied input to determine the destination of an HTTP 30x response. Without an allowlist of permitted hosts, any absolute URL provided by the attacker becomes a valid redirect target.
Attack Vector
An unauthenticated remote attacker crafts a URL pointing to the vulnerable endpoint on the library automation application and appends a redirect parameter pointing to an attacker-controlled domain. The victim receives the link through phishing infrastructure and clicks it, believing the URL belongs to their library system. The browser follows the redirect, landing on a page that impersonates the legitimate login portal or delivers malicious payloads. Refer to the USOM advisory TR-26-1036 for additional technical context.
Detection Methods for CVE-2026-78377
Indicators of Compromise
- HTTP access logs showing requests to the library application with external absolute URLs in redirect-related query parameters such as url=, next=, return=, or redirect=.
- Referer headers on external phishing pages pointing back to the trusted Yordam library application hostname.
- User reports of authentication prompts appearing on unfamiliar domains immediately after clicking a link to the library platform.
Detection Strategies
- Parse web server and reverse proxy logs for redirect parameters containing schemes or hostnames outside the organization's allowlist.
- Correlate outbound proxy telemetry with library application referrers to identify users being funneled to newly registered or low-reputation domains.
- Deploy phishing simulation and URL reputation scanning on inbound email to flag messages containing library application links with suspicious query strings.
Monitoring Recommendations
- Enable verbose logging on the library automation application for all endpoints that issue HTTP redirects.
- Alert when redirect parameters contain URL-encoded characters, protocol-relative URLs, or @ characters used to obscure the true destination.
- Monitor DNS resolution for lookalike domains impersonating the library or parent institution.
How to Mitigate CVE-2026-78377
Immediate Actions Required
- Upgrade the Library Information and Document Automation Program to version v22.2 or later.
- Restrict access to the vulnerable application through network controls until patching is complete.
- Notify library users of active phishing risk and instruct them to verify domain names before submitting credentials.
Patch Information
Yordam addresses the issue in version v22.2. Administrators running any release from v22.1 up to but not including v22.2 must upgrade to receive the fix. Consult the USOM notification TR-26-1036 for vendor coordination details.
Workarounds
- Configure a reverse proxy or web application firewall to strip or validate redirect parameters against an allowlist of internal hostnames.
- Enforce Content Security Policy and browser-side protections that warn users when navigating to external domains from the library portal.
- Disable or block application endpoints that accept redirect parameters if they are not required for business operations.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
