CVE-2026-2153
📋 TL;DR
This CVE describes an open redirect vulnerability in mwielgoszewski's doorman application up to version 0.6. Attackers can manipulate the 'Next' parameter to redirect users to malicious websites after authentication. This affects all users of vulnerable doorman installations.
💻 Affected Systems
- mwielgoszewski doorman
📦 What is this software?
Doorman by Mwielgoszewski
⚠️ Risk & Real-World Impact
Worst Case
Users could be redirected to phishing sites that steal credentials or deliver malware after legitimate authentication.
Likely Case
Attackers use the redirect for phishing campaigns, tricking users into visiting malicious sites while appearing to come from a trusted source.
If Mitigated
With proper URL validation and user awareness, impact is limited to potential confusion but no direct compromise.
🎯 Exploit Status
Exploit requires user interaction (clicking a link) but is trivial to implement once the vulnerability is understood.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 0.7 or later
Vendor Advisory: https://github.com/mwielgoszewski/doorman
Restart Required: Yes
Instructions:
1. Update doorman to version 0.7 or later. 2. Restart the doorman service. 3. Verify the fix by testing redirect functionality.
🔧 Temporary Workarounds
Input validation middleware
allAdd middleware to validate and sanitize all URL parameters before processing.
# Add custom middleware to validate 'Next' parameter
# Implementation depends on your specific Django/Flask setup
Domain whitelist
allRestrict redirects to pre-approved domains only.
# Modify is_safe_url function to check against whitelist
ALLOWED_REDIRECT_DOMAINS = ['yourdomain.com', 'trusted.com']
🧯 If You Can't Patch
- Implement WAF rules to block redirects to external domains from authentication endpoints.
- Educate users about phishing risks and verify URLs before clicking redirects.
🔍 How to Verify
Check if Vulnerable:
Check doorman version: if version <= 0.6, test by attempting to redirect to external domain using Next parameter.Check Version:
pip show doorman | grep VersionVerify Fix Applied:
After updating to 0.7+, test that redirects to external domains are blocked or properly validated.📡 Detection & Monitoring
Log Indicators:
- Unusual redirect patterns in authentication logs
- Multiple failed redirect attempts to external domains
Network Indicators:
- HTTP 302 redirects to unexpected external domains after authentication
SIEM Query:
source="doorman" AND (url="*Next=*" OR status=302) AND url!="*yourdomain.com*"