CVE-2026-40080 Details
Description
Cacti is an open source performance and fault management framework. Versions 1.2.30 and prior are vulnerable to Open Redirect through a substring check rather than a host check at str_contains($referer, CACTI_PATH_URL). When the user's login_opts == '1' (redirect to referer after login), the function used $_SERVER['HTTP_REFERER'] directly. An attacker could craft a referer such as https://evil.com/cacti/. Where CACTI_PATH_URL is /cacti/, the substring matches and the user is redirected to evil.com after login. The pre-existing validate_redirect_url() helper at lib/html_utility.php performed proper validation but was not invoked from auth_login_redirect(). This issue has been fixed in version 1.2.31.
An open redirect vulnerability has been identified in Cacti, an open-source performance and fault management framework, in versions through 1.2.30. The issue arises in the authentication login redirect process, where the validation of the HTTP Referer header is based on a substring match rather than a proper host check. This flaw allows an attacker to craft a referer that, when matched, redirects the user to a malicious site after login. The vulnerability was not present in the validation function, which could have properly handled the referer check.
Users can upgrade to Cacti version 1.2.31, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jun 26, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/Cacti/cacti/security/advisories/GHSA-6gr7-53g8-vchq | CISA-ADP | ExploitMitigationVendor Advisory |
| https://github.com/Cacti/cacti/releases/tag/release%2F1.2.31 | [email protected] | ProductRelease Notes |
| https://github.com/Cacti/cacti/security/advisories/GHSA-6gr7-53g8-vchq | [email protected] | ExploitMitigationVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-601 | URL Redirection to Untrusted Site ('Open Redirect') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| cacti cacti | < 1.2.31 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 29, 2026 | Initial Analysis | [email protected] |
| Jun 26, 2026 | CVE Modified | CISA-ADP |
| Jun 25, 2026 | New CVE Received | [email protected] |