CVE-2025-60935

Published: Dec 24, 2025Modified: Jun 17, 2026

6.1

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Exploitability: 2.8 / Impact: 2.7

Source: NVD

Description

An open redirect vulnerability in the login endpoint of Blitz Panel v1.17.0 allows attackers to redirect users to malicious domains via a crafted URL. This issue affects the next_url parameter in the login endpoint and could lead to phishing or token theft after successful authentication.

Affected (1)

Products: Returnfi: Blitz

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Returnfi Blitz	Version 1.17.0

Related CWEs

URL Redirection to Untrusted Site ('Open Redirect')

A web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a Redirect. This simplifies phishing attacks.

References (2)

https://gist.github.com/HEXER365/2e866b47d56585e1e59e7c16bf4b4db7

Source: cve@mitre.org

Third Party Advisory

https://github.com/ReturnFI/Blitz

Source: cve@mitre.org

Product

Timeline

No history available yet.