PT-2026-48458 · Roxy-Wi · Roxy-Wi

Published 2026-06-10 · Updated 2026-06-10 · CVE-2026-45566

NVD

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. In versions 8.2.6.4 and prior, the login flow allow-lists next URLs by rejecting strings containing https:// or http:// substrings, then constructs https://{request.host}{next url} and the JS client redirects via window.location.replace(). The block does not consider the userinfo@host syntax. next=@evil.example/path produces https://[e-mail]/path, which all modern browsers route to evil.example. At time of publication, there are no publicly available patches.

Fix

Open Redirect

Weakness Enumeration

CWE-601

Related Identifiers

CVE-2026-45566

Affected Products

Roxy-Wi

References · 2

• https://nvd.nist.gov/vuln/detail/CVE-2026-45566 · Security Note
• https://github.com/roxy-wi/roxy-wi/security/advisories/GHSA-xw9x-68gg-mp5h · Note