CVE-2025-58044

JumpServer is an open source bastion host and an operation and maintenance security audit system. Prior to v3.10.19 and v4.10.5, The /core/i18n// endpoint uses the Referer header as the redirection target without proper validation, which could lead to an Open Redirect vulnerability. This vulnerability is fixed in v3.10.19 and v4.10.5.

CVSS 4.0

5.5CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:L/E:P

CVSS 3.1

6.1CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

EPSS

0.5% chance of exploitation in the next 30 days; higher than 41% of CVEs (scores of 2026-10-25)

CWE

CWE-601

Published

2025-12-01

Modified

2026-10-19

Record from

the NVD, synced 2026-10-19

Affected

• fit2cloud:jumpserver

References

• https://github.com/jumpserver/jumpserver/commit/36ae076cb021f16d2053a63651bc16d15a3ed53b
• https://github.com/jumpserver/jumpserver/security/advisories/GHSA-h762-mj7p-jwjq

Check your stackJSON