PT-2026-20646 · Busy · Busy

Zast.Ai · Published 2026-02-19 · Updated 2026-02-19 · CVE-2026-2709

Positive Technologies (AI Summary)

CVSS v2.0

4.0

Medium

Base vector

AV:N/AC:L/Au:S/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions busy versions 2.5.5 and earlier

Description A flaw exists in busy that could allow for open redirect attacks. The issue is located within an unknown function in the file source-code/busy-master/src/server/app.js of the Callback Handler component. Manipulation of the state argument can trigger the flaw. The attack can be launched remotely. The project has been informed of the issue but has not yet responded.

Recommendations Update to a version newer than 2.5.5.

Exploit

Fix

Open Redirect

Weakness Enumeration

CWE-601

Related Identifiers

CVE-2026-2709

Affected Products

Busy

References · 9

• 🔥 https://github.com/busyorg/busy/issues/2287#issue-3905518966 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-2709 · Security Note
• https://osv.dev/vulnerability/CVE-2026-2709 · Vendor Advisory
• https://github.com/busyorg/busy/issues/2287 · Note
• https://vuldb.com/?id.346661 · Note
• https://vuldb.com/?submit.753299 · Note
• https://t.me/CVEtracker/45088 · Telegram Post
• https://vuldb.com/?ctiid.346661 · Note
• https://twitter.com/CVEnew/status/2024501265284440186 · Twitter Post