CVE-2026-96773: Subrion CMS Open Redirect Vulnerability

CVE-2026-96773 Overview

CVE-2026-96773 is an open redirect vulnerability [CWE-601] in Intelliants Subrion CMS versions up to 4.2.1. The flaw resides in the iaUsers::authorize function within front/login.php, part of the Login Page component. Attackers manipulate the $_SERVER['HTTP_REFERER'] value to redirect authenticated users to attacker-controlled destinations. Exploitation requires user interaction, typically clicking a crafted link. Public exploit details are available, and the vendor did not respond to disclosure outreach.

Critical Impact

Attackers can leverage the trusted Subrion CMS login domain to redirect users to phishing or malware distribution sites, enabling credential theft campaigns against site users.

Affected Products

• Intelliants Subrion CMS versions through 4.2.1
• front/login.php component (Login Page)
• iaUsers::authorize authentication function

Discovery Timeline

• 2026-09-24 - CVE-2026-96773 published to the National Vulnerability Database (NVD)
• 2026-09-24 - Last updated in NVD database

Technical Details for CVE-2026-96773

Vulnerability Analysis

The vulnerability affects the login workflow of Subrion CMS, a PHP-based content management system developed by Intelliants. During authentication processing in iaUsers::authorize, the application reads the HTTP Referer header from $_SERVER['HTTP_REFERER'] and uses the value as a post-login redirect target. The application does not validate that this value points to a trusted host or path within the Subrion application.

Because the Referer header is attacker-controllable, a crafted request can direct the user to any external URL after login. Open redirect flaws of this class [CWE-601] are commonly chained with phishing. Victims see the legitimate Subrion domain in the initial URL, which lowers suspicion before the redirect to a hostile destination.

Root Cause

The root cause is missing allowlist validation on the redirect target. iaUsers::authorize trusts user-supplied header data without comparing it against the application's own hostname or an approved set of return URLs. Any value received in the Referer header is accepted as a navigation destination.

Attack Vector

An attacker crafts a link to the Subrion login page and arranges for the victim's browser to send a controlled Referer header, for example by hosting a page that links to the login endpoint. When the victim authenticates, the application reads the attacker-controlled header and issues an HTTP redirect to the external site. The attack is network-reachable and does not require authentication on the attacker's side, but it does require user interaction. Technical details are described in the GitHub Security Advisory and the VulDB entry for CVE-2026-96773.

Detection Methods for CVE-2026-96773

Indicators of Compromise

• Login requests to front/login.php carrying a Referer header pointing to an external domain unrelated to the Subrion site.
• HTTP 302 responses from the login endpoint whose Location header targets a domain outside the Subrion deployment.
• User reports of being redirected to unexpected or suspicious sites immediately after signing in.

Detection Strategies

• Inspect web server access logs for POST requests to front/login.php where the Referer header does not match the site's own hostname.
• Correlate authentication events with outbound redirect destinations and flag mismatches between request origin and redirect target.
• Deploy web application firewall rules that validate the Referer header on login requests against an allowlist of trusted hosts.

Monitoring Recommendations

• Alert on repeated login attempts originating from the same off-site referrer, which may indicate phishing lure traffic.
• Monitor DNS and proxy logs for user navigation from the Subrion login domain to newly registered or low-reputation domains.
• Review threat intelligence feeds for phishing campaigns that abuse Subrion CMS login redirects.

How to Mitigate CVE-2026-96773

Immediate Actions Required

• Restrict access to the Subrion CMS login interface at the network edge where feasible, pending a code-level fix.
• Deploy web application firewall rules that reject or sanitize untrusted Referer values on front/login.php.
• Notify site users to be cautious of unexpected redirects following login and to report suspicious behavior.

Patch Information

No vendor patch is currently referenced in the enriched data. The disclosure notes that Intelliants did not respond to coordinated disclosure outreach. Operators should track the GitHub Security Advisory and VulDB vulnerability record 409028 for updates. Consider migrating off Subrion CMS if the project remains unmaintained.

Workarounds

• Modify iaUsers::authorize in front/login.php to validate the redirect target against an allowlist of local paths or the application's own hostname.
• Replace reliance on $_SERVER['HTTP_REFERER'] with a server-side session value that stores only internally generated return URLs.
• Enforce a fixed, safe landing page after login (for example, the user dashboard) and ignore any client-supplied redirect value.

# Example Apache mod_rewrite rule to block external Referer values on the login endpoint
RewriteEngine On
RewriteCond %{REQUEST_URI} ^/front/login\.php$
RewriteCond %{HTTP_REFERER} !^https?://(www\.)?your-subrion-domain\.tld/ [NC]
RewriteCond %{HTTP_REFERER} !^$
RewriteRule .* - [F,L]