CVE-2026-81509 Details

A post-authentication open redirect vulnerability has been identified in nforwardauth versions prior to 1.5.1. The issue arises because the application accepts an unvalidated 'r' query parameter on the '/login' endpoint, using it as the redirect destination after authentication. This vulnerability allows an unauthenticated attacker to craft a login URL that redirects a victim to an attacker-controlled site, potentially facilitating phishing and social engineering attacks by exploiting the trust in the legitimate authentication domain.

Users can update to nforwardauth version 1.5.1, which patches the vulnerability by validating the 'r' parameter to ensure it only redirects to trusted destinations.