CVE-2026-12863 | An unvalidated redirect was contained in Venueless' social l… | CVSS 5.1 MEDIUM

Description

An unvalidated redirect was contained in Venueless' social login functionality and could be exploited for phishing using trusted domains.

CVE ID: CVE-2026-12863
State: PUBLISHED
Assigner: rami.io
Reserved: 2026-06-22 08:17 UTC
Published: 2026-06-22 08:41 UTC
Last updated: 2026-06-22 10:27 UTC
Primary CWE: CWE-601
CWE-601 URL redirection to untrusted site ('open redirect')
Vendor / Product: pretix / Venueless
Sources: cve.org · NVD

5.1 MEDIUM CVSS 4.0

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N

SSVC — CISA Coordinator

Affected products (1)

Vendor	Product	Platform	Versions
pretix	Venueless	—	0.0.0 < d27864a7

Weakness (CWE)

CWE	Source	Description
CWE-601	cna	CWE-601 URL redirection to untrusted site ('open redirect')

CVSS scores (1)

Score	Severity	Version	Source	Vector
5.1	MEDIUM	4.0	cna	CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N

References (1)