CVE-2024-21641

Deeper analysis

Flarum, an open source discussion platform, is affected by an open redirect vulnerability in the /logout route prior to version 1.8.5. The route accepts an unvalidated redirect parameter that permits redirection from the trusted installation domain to an arbitrary external URL. The issue is tracked as CWE-601 and carries a CVSS 3.1 score of 6.5.

Any unauthenticated attacker can exploit the flaw by supplying a crafted logout URL. Guests are redirected immediately, while logged-in users are redirected after confirming the logout action. The primary impact is abuse of the trusted domain for spam or phishing campaigns that direct visitors to attacker-controlled sites.

The vulnerability was addressed in flarum/core 1.8.5. The official GitHub Security Advisory and associated commits document the fix, and administrators are advised to upgrade. As a temporary workaround, certain third-party extensions that override the logout route may mitigate the issue provided their own redirect handling is implemented securely.

The EPSS score has remained near 0.38 with only minor fluctuation between its current and peak values, indicating no significant post-disclosure surge in observed exploitation interest.