PT-2026-6981 · Mwielgoszewski · Doorman

Racerz · Published 2026-02-08 · Updated 2026-04-06 · CVE-2026-2153

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions mwielgoszewski doorman versions prior to 0.7

Description A flaw exists in the is safe url function within the doorman/users/views.py file. Manipulation of the Next argument can result in an open redirect. This issue can be exploited remotely. The exploit has been publicly disclosed.

Recommendations Update to version 0.7 or later. As a temporary workaround, consider restricting or validating the Next parameter to prevent redirection to untrusted URLs.

Exploit

Fix

Open Redirect

Weakness Enumeration

CWE-601

Related Identifiers

CVE-2026-2153

Affected Products

Doorman

References · 10

• 🔥 https://gist.github.com/RacerZ-fighting/39f230feb0e450ae54f0a80c63c5d924 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-2153 · Security Note
• https://osv.dev/vulnerability/CVE-2026-2153 · Vendor Advisory
• https://twitter.com/aviatrixtrc/status/2041190993135816871 · Twitter Post
• https://vuldb.com/?id.344855 · Note
• https://vuldb.com/?submit.748072 · Note
• https://t.me/cveNotify/154412 · Telegram Post
• https://t.me/CVEtracker/44102 · Telegram Post
• https://t.me/cveNotify/151299 · Telegram Post
• https://vuldb.com/?ctiid.344855 · Note