Unknown · Nopcommerce · CVE-2022-26954
**Name of the Vulnerable Software and Affected Versions**
NopCommerce versions 4.10 through 4.50.1
**Description**
The issue allows remote attackers to conduct phishing attacks by redirecting users to attacker-controlled web sites via the `returnUrl` parameter. This parameter is processed by several functions, including the `ChangePassword` function, `SignInCustomerAsync` function, `SuccessfulAuthentication` method, or the `NopRedirectResultExecutor` class.
**Recommendations**
For NopCommerce versions 4.10 through 4.50.1, consider disabling the `returnUrl` parameter in the affected functions until a patch is available.
Restrict access to the `ChangePassword` function, `SignInCustomerAsync` function, `SuccessfulAuthentication` method, and the `NopRedirectResultExecutor` class to minimize the risk of exploitation.
Avoid using the `returnUrl` parameter in the affected API endpoints until the issue is resolved.