---
id: CVE-2026-66414
title: Leantime Open Redirect in Login Controller via redirectUrl Parameter
summary: >-
  Leantime 3.6.2 contains an open redirect vulnerability in the Login controller
  that allows unauthenticated attackers to redirect authenticated users to
  arbitrary external sites by manipulating the redirectUrl POST parameter.
  Attackers ca…
severity: medium
cvss: 6.1
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N'
cvssSource: cna
cwe:
  - CWE-601
vendor: Leantime
product: Leantime
affected:
  - Leantime <= 3.6.2
ssvc:
  exploitation: poc
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-07-30T17:40:57.760751Z'
exploitAvailable: true
published: '2026-07-30'
updated: '2026-09-24'
sourceUpdated: '2026-09-24T14:18:21.895Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-66414'
references:
  - url: 'https://github.com/Leantime/leantime/pull/3658'
    label: Pull Request
  - url: >-
      https://github.com/javokhir-sec/CVE-PoC-Hub/security/advisories/GHSA-wprg-q8m6-jhp9
    label: GitHub Security Advisory (GHSA-wprg-q8m6-jhp9)
  - url: 'https://github.com/Leantime/leantime'
    label: Product Repository
  - url: >-
      https://www.vulncheck.com/advisories/leantime-open-redirect-in-login-controller-via-redirecturl-parameter
tags:
  - cve.org
  - exploit-available
epss: 0.00345
epssPercentile: 0.25273
ingestedAt: '2026-09-24T15:45:56.720Z'
---

## Overview

Leantime 3.6.2 contains an open redirect vulnerability in the Login controller that allows unauthenticated attackers to redirect authenticated users to arbitrary external sites by manipulating the redirectUrl POST parameter. Attackers can craft a malicious login URL with a tampered redirectUrl value that bypasses FILTER_SANITIZE_URL validation to redirect victims to attacker-controlled sites for phishing or credential theft.

## Affected

- `Leantime <= 3.6.2`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.