A critical denial of service vulnerability in LimeSurvey 6.13.0 allows unauthenticated attackers to exhaust system resources through infinite HTTP redirect loops.

The vulnerability exists in the /optin endpoint, which lacks proper exit conditions for HTTP redirects. This flaw allows an unauthenticated attacker to trigger an infinite redirect loop that causes resource exhaustion and service degradation.

The exploitation of this vulnerability results in a denial of service condition, rendering the LimeSurvey application unavailable to legitimate users. Given the CVSS score of 7.5, this high severity issue poses a significant risk to business continuity and operational uptime for organizations relying on the platform for data collection.

Immediate Action: Update the LimeSurvey installation to version 6.15.0 or later to resolve the redirect loop issue.

Proactive Monitoring: Review web server access logs for anomalous patterns of repeated requests to the /optin endpoint, which may indicate exploitation attempts.

Compensating Controls: Implement rate limiting on the /optin endpoint using a Web Application Firewall (WAF) to prevent automated resource exhaustion attacks until the patch is applied.

Public Exploit Available: Unknown

The vulnerability presents a clear risk to service availability through simple resource exhaustion. Organizations utilizing LimeSurvey version 6.13.0 must prioritize upgrading to version 6.15.0 immediately to eliminate this exposure and restore service stability.