CVE-2026-112034 Details

An open redirect vulnerability has been identified in aircheng-org iWebShop-5 versions through 5.16. The issue arises in the Login Redirect component, specifically within the IController::redirect function of plugins/_userInfo/_userInfo.php. The vulnerability allows for remote exploitation by manipulating the callback parameter, which is not properly validated before being used for redirection. This flaw could be exploited to redirect users to malicious sites, potentially leading to phishing attacks or token theft.

To address this vulnerability, validate the callback parameter to ensure it only contains relative in-app paths. Reject any URLs that include 'http:', 'https:', '//', or backslash variants. Additionally, consider implementing a server-side allow-list of named routes to manage callback redirections.