CVE-2026-81913: Concrete CMS Open Redirect Vulnerability

CVE-2026-81913 is an open redirect vulnerability in Concrete CMS versions 9.5.0 through 9.5.2 via the rcURL parameter. Attackers can redirect authenticated users to malicious sites for phishing attacks. This article covers technical details, affected versions, impact assessment, and mitigation strategies.

CVE-2026-81913 Overview

CVE-2026-81913 is an Open Redirect vulnerability [CWE-601] in Concrete CMS versions 9.5.0 through 9.5.2. The flaw exists in the handling of the rcURL parameter, which fails to properly validate redirect destinations against the intended allowlist. An attacker can craft a link hosted on the site's own domain that sends an authenticated user to an arbitrary external site immediately after login. The same handling is present in the registration flow, providing a second entry point on sites where user registration is enabled. Concrete CMS versions prior to 9.5.0 do not implement the rcURL parameter and are not affected.

Critical Impact
Attackers can leverage the trusted Concrete CMS domain to redirect users to attacker-controlled sites after authentication, facilitating phishing campaigns and credential theft.

Affected Products

Concrete CMS 9.5.0
Concrete CMS 9.5.1
Concrete CMS 9.5.2

Discovery Timeline

Vulnerability reported by Michal M. to the Concrete CMS security team
2026-09-11 - CVE-2026-81913 published to NVD
2026-09-15 - Last updated in NVD database

Technical Details for CVE-2026-81913

Vulnerability Analysis

The vulnerability resides in the login and registration flows of Concrete CMS. Both flows accept an rcURL query parameter that specifies where the user should be redirected after successful authentication. The parameter is intended to be restricted to safe internal destinations through an allowlist check. The check fails to correctly validate the supplied URL, allowing attackers to supply arbitrary external destinations.

Because the initial link points to the legitimate Concrete CMS domain, users and email security controls are more likely to trust it. After the user authenticates, the browser follows the attacker-controlled rcURL value to a phishing page that can mimic the original site and harvest credentials or session material.

Root Cause

The root cause is improper validation of a user-controlled redirect target [CWE-601]. The rcURL parameter handler in versions 9.5.0 through 9.5.2 does not enforce the same-origin or allowlist restriction it was designed to apply. Requests containing external URLs pass validation and are used as the post-authentication destination.

Attack Vector

Exploitation requires user interaction but no privileges. An attacker distributes a crafted URL such as https://victim-site.example/login?rcURL=https://attacker.example/phish through email, chat, or social media. When a victim clicks the link and completes authentication on the legitimate Concrete CMS site, the application redirects the browser to the attacker-controlled destination. The registration endpoint exhibits the same behavior on sites that permit self-registration.

No exploitation code is required beyond a crafted URL. See the Concrete CMS Release Notes for advisory context.

Detection Methods for CVE-2026-81913

Indicators of Compromise

Web server access logs containing login or registration requests with an rcURL parameter pointing to external domains.
Referer headers on outbound traffic showing users leaving the Concrete CMS login flow toward unfamiliar hosts.
Reports of phishing pages that mimic the Concrete CMS site after users follow links from the legitimate domain.

Detection Strategies

Inspect HTTP request logs for rcURL values whose host does not match the site's own domain or approved subdomains.
Correlate authentication events with immediate outbound redirects to non-corporate destinations.
Deploy URL reputation checks on outbound web traffic to flag known phishing infrastructure reached via redirect.

Monitoring Recommendations

Enable verbose logging on the Concrete CMS login and registration handlers, including full query strings.
Forward web server and application logs to a centralized analytics platform for query-based hunting on rcURL.
Alert on any spike in requests to /login or the registration endpoint that carry an rcURL parameter.

How to Mitigate CVE-2026-81913

Immediate Actions Required

Upgrade Concrete CMS to version 9.5.3 or later, which addresses the rcURL allowlist bypass.
Audit web server logs for prior use of rcURL with external hosts and notify potentially affected users.
Reinforce user awareness that authentication prompts from any source can precede unexpected redirects.

Patch Information

Concrete CMS resolved the issue in the 9.5.3 release. Consult the Concrete CMS 9.5.3 Release Notes for the full changelog and upgrade instructions. Sites running versions prior to 9.5.0 are not affected and do not require this patch.

Workarounds

Disable public user registration on sites that do not require it to close the second exploitation entry point.
Deploy a web application firewall rule that strips or blocks rcURL parameters containing off-domain hosts.
Restrict access to the login endpoint through IP allowlisting on administrative deployments where feasible.

bash

# Example WAF rule to block external rcURL values (ModSecurity syntax)
SecRule ARGS:rcURL "!@beginsWith https://your-site.example/" \
    "id:1008191,phase:2,deny,status:400,\
    msg:'CVE-2026-81913: External rcURL redirect blocked'"