CVE-2026-93869: Cotonti CMS Open Redirect Vulnerability

CVE-2026-93869 Overview

CVE-2026-93869 is an open redirect vulnerability [CWE-601] affecting Cotonti content management system versions through 1.0.0. The flaw resides in the cot_url_check() function within the system functions library. This function validates redirect destinations using a regular expression that lacks an end-of-string anchor. Attackers can bypass the redirect guard by crafting hostnames that begin with the trusted site domain. The bypass allows redirection of users to attacker-controlled hosts through the ratings plugin or other callers that rely on cot_url_check() for validation.

Critical Impact
Attackers can redirect authenticated or unauthenticated Cotonti users to arbitrary attacker-controlled domains, enabling phishing and credential harvesting campaigns that appear to originate from the trusted site.

Affected Products

Cotonti CMS versions through 1.0.0
The cot_url_check() function in system/functions.php
The ratings plugin (plugins/ratings/ratings.ajax.php) and other components invoking the redirect guard

Discovery Timeline

2026-09-18 - CVE-2026-93869 published to the National Vulnerability Database
2026-09-22 - Last updated in NVD database

Technical Details for CVE-2026-93869

Vulnerability Analysis

Cotonti's cot_url_check() function is the central guard that determines whether a redirect target is considered same-origin. The function applies a regular expression against the supplied URL to confirm it matches the configured site domain. Because the regex omits an end-of-string anchor (for example $), any string that merely begins with the site domain passes validation. An attacker can register or control a hostname such as example.com.evil.tld and satisfy the check even though the effective destination is evil.tld. The ratings plugin passes user-supplied redirect targets through this guard, which turns the missing anchor into an exploitable open redirect. Refer to the VulnCheck Advisory for Cotonti for the coordinated disclosure details.

Root Cause

The root cause is an incomplete regular expression in cot_url_check(). The pattern anchors the start of the string but not the end. Input validation relying on prefix matching alone is insufficient for domain comparisons because DNS hostnames are hierarchical and read right-to-left.

Attack Vector

Exploitation requires user interaction. An attacker crafts a URL pointing at a Cotonti endpoint that consumes a redirect parameter, such as the ratings AJAX handler in plugins/ratings/ratings.ajax.php. The attacker supplies a redirect target whose hostname begins with the victim site's domain but resolves to attacker infrastructure. When a user clicks the link, Cotonti issues an HTTP redirect to the attacker-controlled host.

No verified proof-of-concept code is published. See GitHub Issue #1891 and GitHub Pull Request #1899 for upstream discussion and the corrective patch.

Detection Methods for CVE-2026-93869

Indicators of Compromise

HTTP 302 responses from Cotonti endpoints whose Location header points to hostnames that begin with the site domain but contain additional labels after it
Access log entries showing redirect parameters passed to ratings.ajax.php or other endpoints invoking cot_url_check() with unusual URL values
Referrer chains in downstream systems that show users transitioning from the Cotonti site to unrelated external domains

Detection Strategies

Inspect web server access logs for query parameters containing URLs where the site domain appears as a prefix of a longer hostname
Alert on outbound Location headers from Cotonti responses that resolve to IPs outside the site's allowed egress ranges
Correlate authentication events with subsequent redirects to identify credential-harvesting funnels that leverage the trusted domain

Monitoring Recommendations

Enable verbose logging on the ratings plugin and any custom callers of cot_url_check()
Forward web logs to a centralized analytics platform and build queries that flag redirect destinations failing suffix-based domain checks
Monitor threat intelligence feeds for phishing campaigns abusing the affected Cotonti domain

How to Mitigate CVE-2026-93869

Immediate Actions Required

Apply the upstream fix referenced in GitHub Pull Request #1899 to any Cotonti deployment at or below version 1.0.0
Audit all callers of cot_url_check() and confirm they receive the corrected validation logic
Review recent web logs for exploitation attempts targeting the ratings plugin redirect flow

Patch Information

The corrective patch adjusts the regular expression in cot_url_check() to anchor the end of the hostname, preventing prefix-match bypasses. Track the fix through the GitHub Cotonti Repository and apply the merged pull request or a subsequent release that incorporates it.

Workarounds

Disable the ratings plugin until the patched cot_url_check() is deployed
Add a web application firewall rule that rejects redirect parameters whose hostname component is not an exact match for the site domain
Replace runtime redirect targets with server-side allowlists that compare full hostnames using equality rather than regular expressions

bash

# Example WAF rule concept: block redirect parameters whose host is not an exact match
# Pseudocode for a reverse proxy filter
if ($arg_redirect ~* "^https?://([^/]+)") {
    set $redirect_host $1;
    if ($redirect_host != "example.com") { return 403; }
}