PT-2025-23122 · Mautic · Mautic

Nick Vanpraet + 2 · Published 2025-05-28 · Updated 2025-05-30 · CVE-2025-5256

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Mautic versions prior to the version that properly validates or sanitizes the returnUrl parameter

Description The issue is related to an Open Redirection vulnerability in Mautic's user unlocking endpoint. This vulnerability could be exploited by an attacker to redirect legitimate users to malicious websites, potentially leading to phishing attacks or the delivery of exploit kits. The vulnerability exists in the "/s/action/unlock/user.user/0" endpoint, where the returnUrl parameter is not properly validated, allowing an attacker to craft a URL that redirects users to an arbitrary external website.

Recommendations Update Mautic to a version that properly validates or sanitizes the returnUrl parameter to ensure that redirects only occur to trusted, internal URLs or explicitly whitelisted domains. As a temporary workaround, consider restricting access to the /s/action/unlock/user.user/0 endpoint to minimize the risk of exploitation. Avoid using the returnUrl parameter in the affected endpoint until the issue is resolved.

Fix

Open Redirect

Weakness Enumeration

CWE-601

Related Identifiers

CVE-2025-5256

GHSA-6VX9-9R2G-8373

Affected Products

Mautic

References · 7

• https://osv.dev/vulnerability/GHSA-6vx9-9r2g-8373 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-5256 · Security Note
• https://osv.dev/vulnerability/CVE-2025-5256 · Vendor Advisory
• https://github.com/mautic/mautic/security/advisories/GHSA-6vx9-9r2g-8373 · Note
• https://github.com/mautic/mautic · Note
• https://twitter.com/CVEnew/status/1927792072251076623 · Twitter Post
• https://t.me/cvetracker/25048 · Telegram Post