CVE-2026-40255

OVERVIEW CVE-2026-40255 is an open redirect vulnerability in the AdonisJS framework affecting @adonisjs/http-server versions prior to 7.8.1 and 8.0.0-next.0 through 8.1.3, as well as @adonisjs/core versions prior to 7.4.0. The vulnerability exists in the response.redirect().back() method, which unsafely redirects users to URLs specified in the HTTP Referer header without validating the destination host. Any AdonisJS application utilizing response.redirect().back() or response.redirect('back') is potentially affected. SEVERITY This vulnerability carries a CVSS 3.1 score of 6.1 (MEDIUM) with a network-based attack vector requiring low complexity and no special privileges, though user interaction is necessary. The attack is straightforward to execute: an attacker can influence the Referer header through a malicious referral link to redirect victims to external malicious sites. The impact includes loss of confidentiality and integrity, as users may be redirected to phishing sites or malware distribution endpoints without obvious indicators of compromise. EXPLOITATION STATUS There is no evidence of active exploitation, as this vulnerability does not appear on the Known Exploited Vulnerabilities (KEV) catalog and is currently inactive on threat tracking lists. The EPSS score of 0.0001 indicates extremely low probability of exploitation in the wild. No public exploit code availability has been reported, and community attention remains minimal.