PT-2026-29411 · Xenforo · Xenforo

Jake B + 2 · Published 2026-04-01 · Updated 2026-04-01 · CVE-2024-58342

Mitre

CVSS v3.1

6.3

Medium

AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L

XenForo before 2.2.17 and 2.3.1 allows open redirect via a specially crafted URL. The getDynamicRedirect() function does not adequately validate the redirect target, allowing attackers to redirect users to arbitrary external sites using crafted URLs containing newlines, user credentials, or host mismatches.

Fix

Open Redirect

Weakness Enumeration

CWE-601

Related Identifiers

CVE-2024-58342

Affected Products

Xenforo

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2024-58342 · Security Note
• https://xenforo.com/community/threads/xenforo-2-2-17-released-security-fix.227797 · Vendor Advisory
• https://vulncheck.com/advisories/xenforo-open-redirect-via-getdynamicredirect · Note