CVE-2026-12379

{
  "id": "CVE-2026-12379",
  "sourceIdentifier": "a59d8014-47c4-4630-ab43-e1b13cbe58e3",
  "published": "2026-07-16T16:18:59.320",
  "lastModified": "2026-10-24T20:10:00.137",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "An Open Redirect vulnerability (CWE-601) exists in the OAuth/OIDC authentication implementation of the Axivion Dashboard. The login flow did not properly restrict the post-authentication redirect to the application's own origin, so a user who follows a crafted login link can be sent to an untrusted external site after authenticating against the genuine Dashboard. Because the link points at the legitimate Dashboard, this can be abused for phishing, for example credential or second-factor theft via a convincing look-alike page. Exploitation requires the victim to follow the attacker-supplied link and complete the authentication flow."
    },
    {
      "lang": "es",
      "value": "Una vulnerabilidad de redirección abierta (CWE-601) existe en la implementación de autenticación OAuth/OIDC del Axivion Dashboard. El flujo de inicio de sesión no restringió adecuadamente la redirección post-autenticación al origen propio de la aplicación, por lo que un usuario que sigue un enlace de inicio de sesión manipulado puede ser enviado a un sitio externo no confiable después de autenticarse contra el Dashboard genuino. Debido a que el enlace apunta al Dashboard legítimo, esto puede ser abusado para phishing, por ejemplo, robo de credenciales o de segundo factor a través de una página convincente de apariencia similar. La explotación requiere que la víctima siga el enlace proporcionado por el atacante y complete el flujo de autenticación."
    }
  ],
  "affected": [
    {
      "source": "a59d8014-47c4-4630-ab43-e1b13cbe58e3",
      "affectedData": [
        {
          "vendor": "Qt",
          "product": "Axivion",
          "defaultStatus": "unaffected",
          "versions": [
            {
              "version": "7.8.0",
              "lessThanOrEqual": "7.8.12",
              "versionType": "python",
              "status": "affected"
            },
            {
              "version": "7.9.0",
              "lessThanOrEqual": "7.9.12",
              "versionType": "python",
              "status": "affected"
            },
            {
              "version": "7.10.0",
              "lessThanOrEqual": "7.10.10",
              "versionType": "python",
              "status": "affected"
            },
            {
              "version": "7.11.0",
              "lessThanOrEqual": "7.11.6",
              "versionType": "python",
              "status": "affected"
            },
            {
              "version": "7.12.0",
              "lessThanOrEqual": "7.12.1",
              "versionType": "python",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV40": [
      {
        "source": "a59d8014-47c4-4630-ab43-e1b13cbe58e3",
        "type": "Secondary",
        "cvssData": {
          "version": "4.0",
          "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:M/U:X",
          "baseScore": 6.8,
          "baseSeverity": "MEDIUM",
          "attackVector": "LOCAL",
          "attackComplexity": "LOW",
          "attackRequirements": "NONE",
          "privilegesRequired": "NONE",
          "userInteraction": "PASSIVE",
          "vulnConfidentialityImpact": "HIGH",
          "vulnIntegrityImpact": "NONE",
          "vulnAvailabilityImpact": "NONE",
          "subConfidentialityImpact": "NONE",
          "subIntegrityImpact": "NONE",
          "subAvailabilityImpact": "NONE",
          "exploitMaturity": "NOT_DEFINED",
          "confidentialityRequirement": "NOT_DEFINED",
          "integrityRequirement": "NOT_DEFINED",
          "availabilityRequirement": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "Safety": "NOT_DEFINED",
          "Automatable": "NOT_DEFINED",
          "Recovery": "NOT_DEFINED",
          "valueDensity": "NOT_DEFINED",
          "vulnerabilityResponseEffort": "MODERATE",
          "providerUrgency": "NOT_DEFINED"
        }
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-07-16T15:58:42.449159Z",
          "id": "CVE-2026-12379",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "a59d8014-47c4-4630-ab43-e1b13cbe58e3",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-601"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://wiki.qt.io/List_of_known_vulnerabilities_in_Qt_products#CVE-2026-12379",
      "source": "a59d8014-47c4-4630-ab43-e1b13cbe58e3"
    }
  ]
}