CVE-2024-58389
6.1 MEDIUMpublic exploit availablePublished 2026-10-12 · Updated 2026-10-16
AI analysis for this CVE has not been generated yet. Raw NVD data is shown below.
NVD description
HoloViz Panel from 1.2.2 before 1.9.0 contains an open redirect vulnerability in panel/auth.py that allows remote attackers to redirect users by supplying an unvalidated next query parameter. BasicLoginHandler and PasswordLoginHandler store the parameter in a next_url cookie, so crafted login links send victims to attacker-controlled external sites after successful login.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weaknesses
CWE-601
Public exploit & PoC references
All references
- https://github.com/holoviz/panel
- https://github.com/holoviz/panel/blob/v1.8.10/panel/auth.py#L866-L900
- https://github.com/holoviz/panel/commit/a6a8b2cb9592a014cf6a7b0d3d5fc9cbf59bb2ed
- https://github.com/holoviz/panel/issues/6782
- https://www.vulncheck.com/advisories/holoviz-panel-from-1.2.2-before-1.9.0-open-redirect-via-next-parameter
Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.
Related CVEs
- MEDIUMCVE-2024-58398PoC
- MEDIUMCVE-2026-100523PoC
- CRITICALCVE-2026-101090PoC
- MEDIUMCVE-2026-101151
- HIGHCVE-2026-101152
- UNSCOREDCVE-2026-101907PoC
- MEDIUMCVE-2026-102090PoC
- UNSCOREDCVE-2026-102778
Related by shared AI tags and CWE weakness class. Browse the full archive.