CVE-2026-40039CWE-305

Pachno 1.0.6 Open Redirection via return_to Parameter

High · published April 13, 2026

CVSS v4.0
7.1
EPSS
0%
Percentile
33.2
In the wild
Unconfirmed
What it is

Pachno 1.0.6 contains an open redirection vulnerability that allows attackers to redirect users to arbitrary external websites by manipulating the return_to parameter. Attackers can craft malicious login URLs with unvalidated return_to values to conduct phishing attacks and steal user credentials.

The record
Technical detail
CVSS v4.0
7.1 · HIGH
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
EPSS
0.00401 · 33.2th percentile
Weakness
CWE-305 · Authentication Bypass by Primary Weakness
Published
2026-04-13T18:10Z
EPSS history
Timeline
  • 13 APR 18:10Z
    Pachno 1.0.6 Open Redirection via return_to Parameter
    cvelistv5