CVE-2025-5256: Mautic Core Open Redirect Vulnerability
Summary
CVE-2025-5256: Mautic has an Open Redirect vulnerability on user unlock path. Affects mautic/core across 3 version ranges.
>= 1.0.0, < 4.4.16
>= 5.0.0-alpha, < 5.2.6
>= 6.0.0-alpha, < 6.0.2
Fixed in 4.4.16, 5.2.6 or 6.0.2, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Mautic is an open-source marketing automation platform that enables businesses to manage their marketing campaigns and customer interactions effectively. It provides features such as email marketing, lead management, and campaign tracking. However, Mautic has been found to have a vulnerability in its user unlocking endpoint, which could be exploited to redirect users to malicious sites.
Vulnerability Detail
The vulnerability is an Open Redirect issue located in the '/s/action/unlock/user.user/0' endpoint of Mautic. The 'returnUrl' parameter, which is supposed to direct users to a safe location after unlocking their accounts, lacks proper validation. This oversight allows attackers to manipulate the URL, redirecting users to arbitrary external sites, potentially leading to phishing attacks or the distribution of exploit kits.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 1.0.0, < 4.4.164.4.16composer require mautic/core:4.4.16 -
>= 5.0.0-alpha, < 5.2.65.2.6composer require mautic/core:5.2.6 -
>= 6.0.0-alpha, < 6.0.26.0.2composer require mautic/core:6.0.2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, ensure that users are informed not to click on suspicious links and to verify the URLs they are directed to after unlocking their accounts. Additionally, consider implementing server-side checks to validate the 'returnUrl' parameter against a list of trusted domains.
Conclusion
The Open Redirect vulnerability in Mautic's user unlocking endpoint poses a significant risk to users, allowing attackers to redirect them to harmful sites. It is crucial to update to the latest patched versions to safeguard against potential exploits. Utilizing tools like Vulert can help monitor for such vulnerabilities effectively.
See every vulnerability recorded for mautic/core →
FAQ
An Open Redirect vulnerability allows an attacker to redirect users from a legitimate site to a malicious one, often leading to phishing or malware distribution.
You can check if your application is affected by using Vulert, which monitors open-source vulnerabilities in real-time. Visit Vulert Scanner to analyze your composer.lock file.
The main risks include phishing attacks, where users may be tricked into providing sensitive information, and the potential delivery of exploit kits that could compromise user systems.
While updating is the best solution, you can mitigate the risk by educating users about the dangers of clicking on unknown links and implementing server-side validation for redirects.
If immediate updates are not possible, ensure that your users are aware of the vulnerability and monitor for any suspicious activity related to your Mautic installation.
References
Related vulnerabilities
Recent vulnerabilities recorded for mautic/core.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
