PT-2026-40245 · Horilla · Horilla

CVE-2026-41513 · Published 2026-05-12 · Updated 2026-05-12

Positive Technologies (AI Summary)

CVSS v4.0

4.8

Medium

Base vector

AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

Name of the Vulnerable Software and Affected Versions Horilla version 1.5.0

Description Notification endpoints trust the unvalidated next parameter, which allows the redirection of users to arbitrary external URLs. This issue can be leveraged by attackers to transform trusted application links into phishing or social-engineering redirects.

Recommendations Update Horilla to a version newer than 1.5.0. As a temporary mitigation, restrict or validate the next parameter in notification endpoints to prevent redirects to external domains.

Exploit

Fix

Open Redirect

Weakness Enumeration

CWE-601

Related Identifiers

CVE-2026-41513

GHSA-VQG4-FC32-CWVW

Affected Products

Horilla

References · 5

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/41xxx/CVE-2026-41513.json · Exploit
• 🔥 https://github.com/horilla/horilla-hr/security/advisories/GHSA-vqg4-fc32-cwvw · Exploit
• https://osv.dev/vulnerability/CVE-2026-41513 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-41513 · Security Note
• https://github.com/horilla/horilla-hr/commit/734f0c7ed4ac96fe8615d1b592180ea8a46eb8b6 · Note