GHSA-hfj7-542q-8fvv · Severity: medium · Ecosystem: npm — DiracX-Web is vulnerable to attack through an Open Redirect on its login page
DiracX-Web is a web application that provides an interface to interact with the DiracX services. Prior to version 0.1.0-a8, an attacker can forge a request that they can pass to redirect an authenticated user to another arbitrary website. In the login page, DiracX-Web has a `redirect` field which is the location where the server will redirect the user. This URI is not verified, and can be an arbitrary URI. Paired with a parameter pollution, an attacker can hide their malicious URI. This could be used for phishing, and extract new data (such as redirecting to a new "log in" page, and asking another time credentials). Version 0.1.0-a8 fixes this vulnerability.
Conclusion & alert: CVE-2025-54066 is rated Low Risk (27.1/100): CVSS Medium severity, with low exploitation likelihood (EPSS 0.32%). Mandatory action: Monitor for updates and reassess as exploit intelligence or EPSS changes.
Risk is dynamic; we continuously reassess and refresh what is shown on this page as upstream context changes.
EPSS lead: Daily EPSS estimates relative likelihood of exploitation; percentile ranks this CVE among scored vulnerabilities (higher = more severe relative rank).
| # | Date | Old EPSS score | New EPSS score | Delta (New - Old) |
|---|---|---|---|---|
| 1 | 2026-06-15 | 0.19% | 0.32% | +0.13% |
| 2 | 2026-05-13 | 0.05% | 0.19% | +0.14% |
| 3 | 2026-05-03 | — | 0.05% | — |
Full EPSS history (6 records total)
CVSS metrics for this CVE.
| Base score | Version | Severity | Vector | Exploitability | Impact | Score source |
|---|---|---|---|---|---|---|
| 4.7 | 3.1 | MEDIUM |
|
2.8 | 1.4 | [email protected] |
GHSA-hfj7-542q-8fvv · Severity: medium · Ecosystem: npm — DiracX-Web is vulnerable to attack through an Open Redirect on its login page
| Vendor | Product | Version | Raw CPE |
|---|---|---|---|
| No affected products in dataset. | |||