CVE-2025-40545

MEDIUM

Solarwinds Observability Self-hosted < 2025.4.1 - Open Redirect

Title source: rule

Description

SolarWinds Observability Self-Hosted is susceptible to an open redirection vulnerability. The URL is not properly sanitized, and an attacker could manipulate the string to redirect a user to a malicious site. The attack complexity is high, and authentication is required.

References (2)

[Release Notes, Vendor Advisory] https://documentation.solarwinds.com/en/success_center/orionplatform/content/release_notes/hco_2025-4-1_release_notes.htm

[Vendor Advisory] https://www.solarwinds.com/trust-center/security-advisories/CVE-2025-40545

Scores

CVSS v3 4.8

EPSS 0.0003

EPSS Percentile 9.6%

Attack Vector ADJACENT_NETWORK

CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N

Classification

CWE

CWE-601

Status published

Affected Products (1)

solarwinds/observability_self-hosted < 2025.4.1

Timeline

Published Nov 18, 2025

Tracked Since Feb 18, 2026