/Vulnerability Library

JumpServer - Open Redirect via Referer Header

CVE-2025-58044
Verified

Description

JumpServer is an open source bastion host and an operation and maintenance security audit system. Prior to v3.10.19 and v4.10.5, The /core/i18n// endpoint uses the Referer header as the redirection target without proper validation, which could lead to an Open Redirect vulnerability.

Severity

Medium

CVSS Score

6.1

Exploit Probability

0%

Affected Product

jumpserver

Published Date

March 25, 2026

Template Author

dhiyaneshdk

CVE-2025-58044.yaml
6.1Score

CVSS Metrics

CVSS Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CVE ID:
cve-2025-58044
CWE ID:
cwe-601

References

https://github.com/jumpserver/jumpserver/security/advisories/GHSA-h762-mj7p-jwjqhttps://github.com/jumpserver/jumpserver/commit/36ae076cb021f16d2053a63651bc16d15a3ed53bhttps://nvd.nist.gov/vuln/detail/CVE-2025-58044

Remediation Steps

Upgrade JumpServer to version 3.10.19 or later (for v3.x) or version 4.10.5 or later (for v4.x).