CVE-2026-40039
MEDIUMPachno 1.0.6 Open Redirection via return_to Parameter
Title source: cnaDescription
Pachno 1.0.6 contains an open redirection vulnerability that allows attackers to redirect users to arbitrary external websites by manipulating the return_to parameter. Attackers can craft malicious login URLs with unvalidated return_to values to conduct phishing attacks and steal user credentials.
References (2)
Core 2
Core References
Third Party Advisory third-party-advisory
Zero Science Lab Disclosure
https://www.zeroscience.mk/en/vulnerabilities/ZSL-2026-5981.php
Third Party Advisory third-party-advisory
VulnCheck Advisory: Pachno 1.0.6 Open Redirection via return_to Parameter
https://www.vulncheck.com/advisories/pachno-open-redirection-via-return-to-parameter
Scores
CVSS v3
6.5
EPSS
0.0034
EPSS Percentile
25.4%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
CISA SSVC
Vulnrichment
Exploitation
none
Automatable
no
Technical Impact
partial
Details
CWE
CWE-305
Status
published
Products (2)
Pachno/Pachno
1.0.6
pancho/Pachno
1.0.6
Published
Apr 13, 2026
Tracked Since
Apr 14, 2026