Statamic Open Redirect Vulnerability in Unauthenticated Endpoints

An open redirect vulnerability has been identified in Statamic CMS versions prior to 5.73.16 and 6.7.2. The issue arises from the external URL detection used for redirect validation on unauthenticated endpoints, which could be bypassed. This flaw allowed users to be redirected to external URLs after performing actions such as form submissions and authentication flows.

Impact

Exploitation of this vulnerability could lead to open redirect behavior, allowing users to be sent to external URLs, potentially facilitating phishing attacks or other malicious activities.

Remediation

Users can upgrade to Statamic CMS versions 5.73.16 or 6.7.2 to address this vulnerability.