Medium 4.3Published Apr 9, 2026

CVE-2026-39985LORIS has an open redirect field on login

Updated under an hour ago (Oct 27, 2026, 1:23 PM ET)

Does this affect you?

It affects aces Loris and 1 other product. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for aces Loris

Exploited in the last 30 days

LORIS (Longitudinal Online Research and Imaging System) is a self-hosted web application that provides data- and project-management for neuroimaging research. Prior to 27.0.3 and 28.0.1, the redirect parameter upon login to LORIS was not validating the value of the redirect as being within LORIS, which could be used to trick users into visiting arbitrary URLs if they are given a link with a third party redirect parameter. This vulnerability is fixed in 27.0.3 and 28.0.1.

CVSS: 4.3 MEDIUM (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Weakness (CWE): CWE-601
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: GitHub_M
NVD analysis: Analyzed
Record last updated: Apr 10, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

aces Loris aces:loris (from the name)	before 27.0.3; from 28.0.0, < 28.0.1	CNA record
mcgill loris mcgill:loris	before 27.0.3; 28.0.0	NVD

References

References

https://github.com/aces/Loris/security/advisories/GHSA-rch2-f5fw-cg95	x-refsource-confirm, vendor-advisory
https://github.com/aces/Loris/commit/f57f54b42a076bf53ba86e20d4dbf37f63538f58	x-refsource-misc, patch
https://github.com/aces/Loris/releases/tag/v27.0.3	x-refsource-misc, release-notes
https://github.com/aces/Loris/releases/tag/v28.0.1	x-refsource-misc, release-notes

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.