CVE-2024-58389 — HoloViz Panel from 1.2.2 before 1.9.0 Open Redirect via next Parameter
HoloViz Panel from 1.2.2 before 1.9.0 contains an open redirect vulnerability in panel/auth.py that allows remote attackers to redirect users by supplying an unvalidated next qu…
Published: 2026-10-12 · CVSS: 5.1 · CVSS 4.0
HoloViz Panel from 1.2.2 before 1.9.0 contains an open redirect vulnerability in panel/auth.py that allows remote attackers to redirect users by supplying an unvalidated next query parameter. BasicLoginHandler and PasswordLoginHandler store the parameter in a next_url cookie, so crafted login links send victims to attacker-controlled external sites after successful login.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7