CVE-2026-80444: AVESİS Open Redirect Vulnerability

CVE-2026-80444 Overview

CVE-2026-80444 is an open redirect vulnerability [CWE-601] affecting Abis Technology Ltd. Co. AVESİS. The flaw allows attackers to manipulate input data so that AVESİS redirects users to attacker-controlled destinations. Successful exploitation requires user interaction, typically by clicking a crafted link.

The issue affects AVESİS builds from 202608201331 before 202608240351. The vulnerability was disclosed through Turkey's national cyber security notification TR-26-1159.

Critical Impact
Attackers can craft AVESİS URLs that redirect authenticated users to malicious sites, enabling phishing, credential harvesting, and malware delivery under the trust of a legitimate domain.

Affected Products

Abis Technology Ltd. Co. AVESİS build 202608201331
Abis Technology Ltd. Co. AVESİS builds after 202608201331 and before 202608240351
Fixed in AVESİS build 202608240351

Discovery Timeline

2026-09-23 - CVE-2026-80444 published to NVD
2026-09-23 - Last updated in NVD database

Technical Details for CVE-2026-80444

Vulnerability Analysis

AVESİS accepts a user-controlled parameter that specifies a redirect destination without validating it against an allowlist of trusted hosts. An attacker crafts a URL pointing to a legitimate AVESİS endpoint but embeds an external target in the redirect parameter. When a victim clicks the link, AVESİS issues an HTTP redirect to the attacker's domain.

Because the initial URL originates from the trusted AVESİS domain, users and security controls that inspect only the initial host are more likely to trust the link. Attackers commonly chain open redirects with phishing pages that mimic the original application's login screen to harvest credentials or session tokens.

The attack requires user interaction and does not grant direct access to AVESİS data or functionality. Impact is limited to confidentiality and integrity of the redirected session, not the AVESİS backend itself.

Root Cause

The root cause is missing or insufficient validation of a redirect target parameter, classified as [CWE-601] URL Redirection to Untrusted Site. AVESİS trusts client-supplied input when constructing the redirect response instead of restricting destinations to a fixed allowlist of internal URLs.

Attack Vector

Exploitation occurs over the network and requires no authentication. An attacker distributes a crafted AVESİS link through email, chat, social media, or a compromised site. The victim clicks the link, AVESİS processes the redirect parameter, and the browser lands on an attacker-controlled page. See the Siber Güvenlik Notification TR-26-1159 for the vendor advisory.

Detection Methods for CVE-2026-80444

Indicators of Compromise

AVESİS access logs containing redirect parameters with absolute URLs pointing to external domains
Referrer headers on suspicious external sites showing an AVESİS origin
User reports of AVESİS links that terminated on unfamiliar login pages
Spikes in outbound redirects from AVESİS URLs to newly registered or low-reputation domains

Detection Strategies

Parse AVESİS web server logs for redirect query parameters and flag values whose host does not match approved internal domains
Correlate email gateway telemetry with AVESİS URLs to detect phishing campaigns that abuse the redirect
Alert on HTTP 302 responses from AVESİS endpoints where the Location header targets an external host

Monitoring Recommendations

Enable URL reputation scanning on email and web proxies for links containing the AVESİS domain
Track user-agent and geolocation anomalies for sessions that follow AVESİS redirects
Retain AVESİS access logs long enough to reconstruct redirect chains during phishing investigations

How to Mitigate CVE-2026-80444

Immediate Actions Required

Upgrade AVESİS to build 202608240351 or later
Inventory AVESİS instances and confirm the running build against the fixed version
Notify users to report suspicious AVESİS links routed through email or messaging platforms
Review web application firewall (WAF) rules to reject redirect parameters containing external hosts

Patch Information

Abis Technology Ltd. Co. resolved the issue in AVESİS build 202608240351. Refer to the Siber Güvenlik Notification TR-26-1159 for vendor guidance and remediation details.

Workarounds

Deploy a WAF rule that blocks requests to AVESİS redirect endpoints when the destination parameter contains a scheme (http:// or https://) or an external hostname
Restrict AVESİS redirects to a server-side allowlist of relative paths until the patch is applied
Add a click-through interstitial warning users when AVESİS forwards them to an external domain

bash

# Configuration example
# Example WAF rule (ModSecurity) to block external redirect targets on AVESİS
SecRule REQUEST_URI "@rx /redirect\?.*url=" \
    "id:1026080444,phase:2,deny,status:403,\
     chain,msg:'CVE-2026-80444 AVESİS open redirect attempt'"
    SecRule ARGS:url "@rx ^https?://(?!avesis\.example\.local)" "t:lowercase"