CVE-2026-53683

reset_password.html parses query string parameters and uses the 'url' parameter as a redirection target (window.location = url) after password reset, optionally delayed by a 'delay' parameter. No validation or allowlisting is performed on url, enabling an attacker to redirect users to an arbitrary external site after completion of the password-reset workflow.

Rated Moderate because exploitation requires a victim to follow a crafted link, and the direct technical impact is limited to a client-side redirect with no data disclosure or modification. The practical risk is phishing/social-engineering enablement rather than a direct technical compromise.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Eliminate arbitrary URL redirects. If a post-reset return URL is required, allowlist same-origin paths only, or validate against a strict allowlist of trusted hosts and the HTTPS scheme. Prefer server-generated, signed return tokens instead of raw URLs, and ensure the UI uses safe navigation helpers that reject dangerous schemes and external origins.