PT-2026-6981 · Mwielgoszewski · Doorman

Racerz · Publicado 2026-02-08 · Atualizado 2026-04-06 · CVE-2026-2153

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions mwielgoszewski doorman versions prior to 0.7

Description A flaw exists in the is safe url function within the doorman/users/views.py file. Manipulation of the Next argument can result in an open redirect. This issue can be exploited remotely. The exploit has been publicly disclosed.

Recommendations Update to version 0.7 or later. As a temporary workaround, consider restricting or validating the Next parameter to prevent redirection to untrusted URLs.

Exploit

Correção

Open Redirect

Enumeração de Fraquezas

CWE-601

Identificadores relacionados

CVE-2026-2153

Produtos afetados

Doorman

Referências · 10

• 🔥 https://gist.github.com/RacerZ-fighting/39f230feb0e450ae54f0a80c63c5d924 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-2153 · Nota de Segurança
• https://twitter.com/aviatrixtrc/status/2041190993135816871 · Publicação no Twitter
• https://vuldb.com/?id.344855 · Nota
• https://vuldb.com/?submit.748072 · Nota
• https://t.me/cveNotify/154412 · Publicação no Telegram
• https://t.me/CVEtracker/44102 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2026-2153 · Aviso do Fabricante
• https://t.me/cveNotify/151299 · Publicação no Telegram
• https://vuldb.com/?ctiid.344855 · Nota