Mautic Open Redirection Vulnerability in User Unlock Endpoint

An open redirection vulnerability has been identified in Mautic's user unlocking endpoint, specifically in versions greater than 1.0. The issue arises because the returnUrl parameter, meant for redirecting users after an action, is not properly validated. This flaw allows attackers to create URLs that redirect users to malicious websites, potentially leading to phishing attacks or the distribution of exploit kits.

Impact

Exploitation of this vulnerability could result in open redirection, allowing attackers to redirect users to external, potentially harmful websites.

Remediation

Users are advised to update Mautic to version 6.0.2, 5.2.6, or 4.4.16, all of which address this vulnerability by properly validating the returnUrl parameter.