CVE-2026-3318
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk27th percentile - higher than 27% of all known CVEs
Summary
The latest demo version of the Cradle eCommerce platform contains an open redirection vulnerability in the login form endpoint. The 'returnUrl' parameter allows redirection because the application accepts a URL as a parameter without proper validation, enabling redirection of users from the legitimate website to external pages.
Risk Assessment
An attacker can deceive users and redirect them from a trusted URL to a malicious one without their knowledge. This can lead to phishing and credential theft.
Recommendation
Implement validation of the returnUrl parameter, restricting redirects to allowed domains only. Update the platform to a version where the vulnerability is fixed.
Other vulnerabilities in Cradle eCommerce
See all- CVE-2026-3320Medium
The latest demo version of the Cradle eCommerce platform contains a reflected Cross-Site Scripting (XSS) vulnerability in the /product/ endpoint. User-controlled input is insecurely reflected in the HTML output, allowing an attacker to execute arbitrary JavaScript code.
- CVE-2026-3319Medium
The latest demo version of the Cradle eCommerce platform contains a reflected Cross-Site Scripting (XSS) vulnerability in the /collection/ endpoint. User-controlled input is insecurely reflected in the HTML output, allowing an attacker to execute arbitrary JavaScript code.
Original NVD description (English source)
Open redirection vulnerability in the latest demo version of the Cradle eCommerce platform. The vulnerability occurs in the login form endpoint, where the ‘returnUrl’ parameter allows redirection because the web application accepts a URL as a parameter without properly validating it. As a result, it is possible to redirect users from the legitimate website to external pages. An attacker could exploit this vulnerability to deceive users and redirect them from a trusted URL to a malicious one without their knowledge.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS