An unauthenticated open redirect vulnerability in e621ng allows attackers to craft malicious links that redirect users to external, attacker-controlled domains.

The application improperly handles untrusted request parameters within the PaginatorComponent and controller navigation links by passing them directly to the Rails url_for helper. This allows an unauthenticated attacker to inject host, protocol, and port parameters, effectively hijacking pagination links to point to arbitrary malicious origins.

The primary risk associated with this vulnerability is the facilitation of phishing attacks, as users may be directed to deceptive sites while under the impression they are navigating the legitimate e621ng platform. While the CVSS score of 6.1 identifies this as a medium-severity issue, the ability to weaponize trusted navigation links can lead to significant reputational damage and the compromise of user credentials or session tokens through social engineering.

Immediate Action: Upgrade the e621ng installation to version 26.09.16 or later to incorporate the patch that properly sanitizes request parameters.

Proactive Monitoring: Review web server and application logs for anomalous navigation requests containing unexpected host or protocol parameters in the query string.

Compensating Controls: Deploy or update Web Application Firewall (WAF) rules to inspect and strip unauthorized URL parameters from incoming requests, specifically targeting pagination and navigation endpoints.

Public Exploit Available: Unknown

Organizations utilizing the e621ng software should prioritize updating to the latest version immediately to eliminate this open redirect vector. By ensuring that user-supplied input is not trusted during the construction of navigation links, administrators effectively neutralize the risk of link-based phishing attempts against their user base.