4.7

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-54066

CVE-2025-54066: DiracX-Web is vulnerable to attack through an Open Redirect on its login page

Summary

An attacker can forge a request to redirect an authenticated user to any arbitrary website.

Details

On the login page, we have a redirect field which is the location where the server will redirect the user. This URI is not verified, and can be an arbitrary URI.

Paired with a parameter pollution, we can hide our malicious URI (ex: https://dns.com/?param1=im_hidden_if_theres_lot_of_args?param1=bbb).

PoC

https://diracx-cert.app.cern.ch/auth?redirect=https://ipcim.com/en/where/?dsdsd=qsqsfsjfnsfniizaeiaapzqlalkqkaizqqijsjaopmqmxna?redirect=https://diracx-cert-app.cern.ch/auth

This POC can leak user's position.

Impact

This could be used for phishing and extracting new data (such as redirecting to a new "log in" page, and asking users to reenter credentials).

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-54066

CVE-2025-54066:

4.7

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
@dirac-grid/diracx-web-components	npm	< 0.1.0-a8	0.1.0-a8

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is an Open Redirect on the login page of DiracX-Web, identified as CVE-2025-54066. The root cause is the lack of validation of the redirect URL parameter, which is used to redirect users after they authenticate.

The analysis of the provided patch eba3b7bc4f9d394074215986e6d3c15b546b25d5 reveals that two React components were involved in this vulnerability:

OIDCSecure: This component is responsible for handling unauthenticated users. The vulnerable version of this component would construct a redirect URL to the login page (/auth) and append the user's current location as a redirect parameter. This action introduced the untrusted data into the application flow.
LoginForm: This component handles the user login process. The vulnerable version of this component would read the redirect parameter from the URL after a successful login and redirect the user to the provided URL without validating it. This is the sink of the vulnerability, where the actual redirection to a potentially malicious site occurs.

The patch rectifies this by removing the logic that handles the redirect parameter. In OIDCSecure, the redirect to the login page no longer includes the redirect parameter. In LoginForm, the post-login redirection is hardcoded to the root path (/), eliminating the possibility of an open redirect.

Therefore, an engineer looking for this vulnerability in their environment should focus on runtime profiles that show calls to OIDCSecure for unauthenticated redirects and LoginForm for post-authentication redirects, as these are the key functions involved in the exploitation of this vulnerability.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.

4.7

-

Basic Information

Basic Information

Concerned about an active attack path?

CVE-2025-54066: DiracX-Web is vulnerable to attack through an Open Redirect on its login page

Summary

Details

PoC

Impact

CVE-2025-54066:

4.7

-

Basic Information

Basic Information

Is this CVE running in your environment?

Technical Details

Technical Details

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

Vulnerability IntelligenceMiggo AI

Unlock WAF rules for this CVE

WAF Protection Rules

WAF Rule

Reasoning

CVE-2025-54066: DiracX-Web is vulnerable to attack through an Open Redirect on its login page

Summary

Details

PoC

Impact

4.7

4.7

Technical Details

Basic Information

Basic Information

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI