PT-2026-20646 · Busy · Busy

Zast.Ai · Publicado 2026-02-19 · Atualizado 2026-02-19 · CVE-2026-2709

Positive Technologies (AI Summary)

CVSS v2.0

4.0

Média

Vetor base

AV:N/AC:L/Au:S/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions busy versions 2.5.5 and earlier

Description A flaw exists in busy that could allow for open redirect attacks. The issue is located within an unknown function in the file source-code/busy-master/src/server/app.js of the Callback Handler component. Manipulation of the state argument can trigger the flaw. The attack can be launched remotely. The project has been informed of the issue but has not yet responded.

Recommendations Update to a version newer than 2.5.5.

Exploit

Correção

Open Redirect

Enumeração de Fraquezas

CWE-601

Identificadores relacionados

CVE-2026-2709

Produtos afetados

Busy

Referências · 9

• 🔥 https://github.com/busyorg/busy/issues/2287#issue-3905518966 · Exploit
• https://github.com/busyorg/busy/issues/2287 · Nota
• https://vuldb.com/?id.346661 · Nota
• https://vuldb.com/?submit.753299 · Nota
• https://t.me/CVEtracker/45088 · Publicação no Telegram
• https://vuldb.com/?ctiid.346661 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-2709 · Nota de Segurança
• https://twitter.com/CVEnew/status/2024501265284440186 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2026-2709 · Aviso do Fabricante