CVE-2026-31819

CVE-2026-31819 is a medium-severity Open Redirect vulnerability (CWE-601) affecting Sylius, an Open Source eCommerce Framework. Specific controllers improperly use the HTTP Referer header for redirection, allowing attackers to redirect users from a trusted domain to a malicious site. Exploitation requires user interaction, where a victim clicks a legitimate application link placed on an attacker-controlled page. This can lead to phishing or credential theft, with public endpoints being trivially exploitable and admin endpoints vulnerable if an authenticated user follows an external link. There is currently no evidence of active exploitation, public exploit code, or significant community attention for this CVE.