CVE-2023-26494

    Dashboard / Vulnerabilities / CVE-2023-26494

    CVE-2023-26494

    Published: 24 Apr 2023Last Modified: 12 Aug 2026

    Summary: lorawan-stack has open redirect vulnerability

    Details: lorawan-stack is an open source LoRaWAN network server. Prior to version 3.24.1, an open redirect exists on the login page of the lorawan stack server, allowing an attacker to supply a user controlled redirect upon sign in. This issue may allows malicious actors to phish users, as users assume they were redirected to the homepage on login. Version 3.24.1 contains a fix.

    References: https://github.com/TheThingsNetwork/lorawan-stack/blob/ecdef730f176c02f7c9afce98b0457ae64de5bfc/pkg/webui/account/views/login/index.js#L90-L90, https://github.com/TheThingsNetwork/lorawan-stack/blob/ecdef730f176c02f7c9afce98b0457ae64de5bfc/pkg/webui/account/views/token-login/index.js#L74-L74, https://github.com/TheThingsNetwork/lorawan-stack/releases/tag/v3.24.1, https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/26xxx/CVE-2023-26494.json, https://nvd.nist.gov/vuln/detail/CVE-2023-26494, https://securitylab.github.com/advisories/GHSL-2022-138_lorawan-stack/, https://github.com/TheThingsNetwork/lorawan-stack/commit/f06776028bdb3994847fc6067613dc61a2b3559e

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0
    Fixed -bd83cb3293fff3e471a0a23a6bee28769ef84f1f

    Affected versions

    v3.17.0
    v3.17.1

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2023-26494 | CVE-DB