{"cve":"CVE-2024-53264","nvd":{"published":"2024-11-27T19:15:33.400","modified":"2026-06-17T08:08:43.037","status":"Deferred","description":"bunkerweb is an Open-source and next-generation Web Application Firewall (WAF). A open redirect vulnerability exists in the loading endpoint, allowing attackers to redirect authenticated users to arbitrary external URLs via the \"next\" parameter. The loading endpoint accepts and uses an unvalidated \"next\" parameter for redirects. Ex. visiting: `/loading?next=https://google.com` while authenticated will cause the page will redirect to google.com. This vulnerability could be used in phishing attacks by redirecting users from a legitimate application URL to malicious sites. This issue has been addressed in version 1.5.11. Users are advised to upgrade. There are no known workarounds for this vulnerability.","cvss_v4":{"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N","score":5.1},"cvss_v3":null,"cwes":["CWE-601"],"references":["https://github.com/bunkerity/bunkerweb/security/advisories/GHSA-q9rr-h3hx-m87g"],"products":[],"source":"nvd","synced_at":"2026-10-19T21:57:34.731061660+00:00"},"epss":{"cve":"CVE-2024-53264","score":0.00792,"percentile":0.56326,"date":"2026-10-31"},"kev":null,"osv":[{"id":"GHSA-q9rr-h3hx-m87g","url":"https://osv.dev/vulnerability/GHSA-q9rr-h3hx-m87g","summary":"BunkerWeb has Open Redirect Vulnerability in Loading Page","modified":"2024-12-02T22:42:06.025932Z","packages":[{"ecosystem":"Go","name":"github.com/bunkerity/bunkerweb","purl":"pkg:golang/github.com/bunkerity/bunkerweb","ranges":["<1.5.11"],"fixed":["1.5.11"]}]},{"id":"GO-2024-3294","url":"https://osv.dev/vulnerability/GO-2024-3294","summary":"Open Redirect Vulnerability in Loading Page in bunkerweb in github.com/bunkerity/bunkerweb","modified":"2026-03-03T04:57:08.127574Z","packages":[{"ecosystem":"Go","name":"github.com/bunkerity/bunkerweb","purl":"pkg:golang/github.com/bunkerity/bunkerweb","ranges":["<1.5.11"],"fixed":["1.5.11"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}