~ / search / GHSA-5fwq-9x7j-2qpg

GHSA-5fwq-9x7j-2qpg

lorawan-stack Open Redirect vulnerability

Source: GitHub Advisory Database (reviewed) Moderate CVE-2023-26494

Packages

EcosystemPackageAffectedFixed in
Go go.thethings.network/lorawan-stack/v3 < 3.24.1 3.24.1

Details

As written in the advisory (Markdown source, shown as plain text).

lorawan-stack is an open source LoRaWAN network server. Prior to version 3.24.1, an open redirect exists on the login page of the lorawan stack server, allowing an attacker to supply a user controlled redirect upon sign in. This issue may allows malicious actors to phish users, as users assume they were redirected to the homepage on login. Version 3.24.1 contains a fix.

References

External links from the advisory. They lead to third-party sites.