CVE-2026-93869 — Cotonti through 1.0.0 Open Redirect via Unanchored cot_url_check() Regex
Cotonti through 1.0.0 contains an open redirect vulnerability in the cot_url_check() function that validates redirect destinations using a regular expression lacking an end-of-s…
Published: 2026-09-18 · CVSS: 5.3 · CVSS 4.0
Cotonti through 1.0.0 contains an open redirect vulnerability in the cot_url_check() function that validates redirect destinations using a regular expression lacking an end-of-string anchor. Attackers can bypass the redirect guard by supplying hostnames beginning with the site domain to redirect users to attacker-controlled hosts through the ratings plugin or other redirect callers.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7