PT-2026-38906 · Unknown · Cradle Ecommerce Platform

Published 2026-05-08 · Updated 2026-05-09 · CVE-2026-3318

Positive Technologies (AI Summary)

CVSS v4.0

5.3

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions Cradle eCommerce platform (affected versions not specified)

Description An open redirection issue exists in the login form endpoint. The application accepts a URL through the returnUrl parameter without proper validation, allowing users to be redirected from the legitimate website to external, potentially malicious pages without their knowledge.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Open Redirect

Weakness Enumeration

CWE-601

Related Identifiers

CVE-2026-3318

Affected Products

Cradle Ecommerce Platform

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2026-3318 · Security Note
• https://t.me/CVEtracker/53110 · Telegram Post
• https://twitter.com/CVEnew/status/2053174682216468567 · Twitter Post
• https://t.me/cveNotify/162699 · Telegram Post
• https://incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-cradle-e-commerce · Note