LORIS Open Redirect Vulnerability in Login Redirect Parameter

An open redirect vulnerability has been identified in LORIS (Longitudinal Online Research and Imaging System) versions prior to 27.0.3 and 28.0.0. The issue arises because the application did not properly validate the redirect parameter during the login process. This lack of validation allowed users to be tricked into visiting arbitrary URLs by including a third-party redirect parameter in the login link.

Impact

Exploitation of this vulnerability could lead to open redirect, allowing users to be redirected to malicious sites.

Remediation

Users can upgrade to LORIS version 27.0.3 or 28.0.1 and above to address this vulnerability.