CVE-2023-26494

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2023-26494
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2023-26494.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2023-26494
Aliases
Published
2023-04-24T16:05:37Z
Modified
2026-10-22T10:35:46Z
Severity
  • 6.1 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CVSS Calculator
Summary
lorawan-stack has open redirect vulnerability
Details

lorawan-stack is an open source LoRaWAN network server. Prior to version 3.24.1, an open redirect exists on the login page of the lorawan stack server, allowing an attacker to supply a user controlled redirect upon sign in. This issue may allows malicious actors to phish users, as users assume they were redirected to the homepage on login. Version 3.24.1 contains a fix.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-601"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/26xxx/CVE-2023-26494.json"
}
References

Affected packages

Git / github.com/thethingsnetwork/lorawan-stack

Affected ranges

Type
GIT
Repo
https://github.com/thethingsnetwork/lorawan-stack
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
bd83cb3293fff3e471a0a23a6bee28769ef84f1f
Fixed
f06776028bdb3994847fc6067613dc61a2b3559e
Database specific
Show details 
{
    "extracted_events": [
        {
            "cpe": "cpe:2.3:a:thethingsnetwork:lorawan-stack:*:*:*:*:*:*:*:*",
            "range": [
                {
                    "introduced": "0"
                },
                {
                    "fixed": "3.24.1"
                }
            ],
            "source": "CPE_RANGE"
        },
        {
            "range": [
                {
                    "fixed": "f06776028bdb3994847fc6067613dc61a2b3559e"
                }
            ],
            "source": "REFERENCES_COMMIT"
        },
        {
            "original_tag": "v3.24.1",
            "range": [
                {
                    "fixed": "bd83cb3293fff3e471a0a23a6bee28769ef84f1f"
                }
            ],
            "source": "REFERENCES_TAG"
        }
    ]
}

Affected versions

v3.*
v3.0.0
v3.0.0-pre
v3.0.0-rc1
v3.0.0-rc2
v3.0.0-rc3
v3.0.1
v3.0.2
v3.0.3
v3.1.0
v3.1.1
v3.1.2
v3.10.0-rc1
v3.10.0-rc2
v3.11.0
v3.11.0-rc1
v3.11.0-rc2
v3.12.0
v3.13.0
v3.14.0
v3.14.1
v3.14.2
v3.15.0
v3.15.1
v3.15.2
v3.16.0
v3.16.1
v3.16.2
v3.17.0
v3.17.1
v3.2.0
v3.2.1
v3.2.2
v3.2.3
v3.2.4
v3.2.5
v3.2.6
v3.3.0
v3.3.1
v3.3.2
v3.4.0
v3.4.1
v3.4.2
v3.5.0
v3.5.1
v3.5.2
v3.6.0
v3.6.0-rc1
v3.7.0
v3.7.0-rc2
v3.9.0
v3.9.0-rc1
v3.9.0-rc2
v3.9.0-rc3
v3.9.0-rc4

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2023-26494.json"