{"id":"CVE-2024-58389","summary":"HoloViz Panel from 1.2.2 before 1.9.0 Open Redirect via next Parameter","details":"HoloViz Panel from 1.2.2 before 1.9.0 contains an open redirect vulnerability in panel/auth.py that allows remote attackers to redirect users by supplying an unvalidated next query parameter. BasicLoginHandler and PasswordLoginHandler store the parameter in a next_url cookie, so crafted login links send victims to attacker-controlled external sites after successful login.","modified":"2026-10-15T02:30:44.323419528Z","published":"2026-10-12T20:55:07.301Z","database_specific":{"cna_assigner":"VulnCheck","cwe_ids":["CWE-601"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/58xxx/CVE-2024-58389.json"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/58xxx/CVE-2024-58389.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-58389"},{"type":"ADVISORY","url":"https://www.vulncheck.com/advisories/holoviz-panel-from-1.2.2-before-1.9.0-open-redirect-via-next-parameter"},{"type":"REPORT","url":"https://github.com/holoviz/panel/issues/6782"},{"type":"FIX","url":"https://github.com/holoviz/panel/commit/a6a8b2cb9592a014cf6a7b0d3d5fc9cbf59bb2ed"},{"type":"PACKAGE","url":"https://github.com/holoviz/panel"},{"type":"ARTICLE","url":"https://github.com/holoviz/panel/blob/v1.8.10/panel/auth.py#L866-L900"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/holoviz/panel","events":[{"introduced":"36a1d92921a86803a6028ff7577515f6ba5d83f1"},{"fixed":"99f03fc315d9830cb32be78768b6ba03b0433df2"},{"fixed":"a6a8b2cb9592a014cf6a7b0d3d5fc9cbf59bb2ed"}],"database_specific":{"extracted_events":[{"introduced":"1.2.2"},{"fixed":"1.9.0"}],"source":["DESCRIPTION","REFERENCES"]}}],"versions":["v1.8.11a0","v1.8.10","v1.8.10rc0","v1.8.10a1","v1.8.10a0","v1.8.9","v1.8.9rc0","v1.8.9a1","v1.8.9a0","v1.8.8b0","v1.8.8a0","v1.8.7","v1.8.7a0","v1.8.6","v1.8.6rc0","v1.8.5","v1.8.5rc0","v1.8.5a2","v1.8.4","v1.8.4rc0","v1.8.4b0","v1.8.3","v1.8.3rc0","v1.8.3a0","v1.8.2","v1.8.2rc1","v1.8.2a1","v1.8.1","v1.8.1rc1","v1.8.1rc0","v1.8.0","v1.8.0rc3","v1.8.0rc2","v1.8.0rc1","v1.8.0b1","v1.8.0a4","v1.8.0a3","v1.8.0a2","v1.8.0a1","v1.8.0a0","v1.7.3","v1.7.3rc1","v1.7.3b1","v1.7.2","v1.7.2rc1","v1.7.2a0","v1.7.1","v1.7.1rc0","v1.7.1a0","v1.7.0","v1.7.0rc1","v1.7.0a1","v1.6.3","v1.6.3rc1","v1.6.3a2","v1.6.3a1","v1.6.2","v1.6.2rc3","v1.6.2rc2","v1.6.2rc1","v1.6.2b1","v1.6.2a4","v1.6.2a3","v1.6.2a2","v1.6.2a1","v1.6.1","v1.6.1rc2","v1.6.1rc1","v1.6.1a1","v1.6.0","v1.6.0rc1","v1.6.0b1","v1.5.5","v1.5.5rc1","v1.5.4","v1.5.4a2","v1.5.4a1","v1.5.3","v1.5.3b1","v1.5.3a1","v1.5.2","v1.5.2a0","v1.5.1","v1.5.1a3","v1.5.1a1","v1.5.0","v1.5.0rc2","v1.5.0rc1","v1.5.0rc0","v1.5.0b6","v1.5.0b8","v1.5.0b7","v1.5.0b5","v1.5.0b4","v1.5.0b3","v1.5.0b2","v1.5.0b1","v1.5.0a8","v1.5.0a7","v1.5.0a6","v1.5.0a5","v1.5.0a3","v1.5.0a2","v1.4.3a1","v1.5.0a1","v1.4.2","v1.4.2rc2","v1.4.2rc1","v1.4.1","v1.4.1rc2","v1.4.1rc1","v1.4.1a1","v1.4.0","v1.4.0rc7","v1.4.0rc6","v1.4.0rc5","v1.4.0rc4","v1.4.0rc3","v1.4.0rc2","v1.4.0rc1","v1.4.0b3","v1.4.0b2","v1.4.0b1","v1.4.0a3","v1.4.0a2","v1.4.0a1","v1.3.4","v1.3.3","v1.3.3rc1","v1.3.2","v1.3.2rc2","v1.3.2rc1","v1.3.2a1","v1.3.1","v1.3.1rc1","v1.3.1a2","v1.3.1a1","v1.3.0","v1.3.0rc3","v1.3.0rc2","v1.3.0rc1","v1.3.0b2","v1.3.0b1","v1.3.0a9","v1.3.0a8","v1.3.0a7","v1.3.0a6","v1.3.0a5","v1.3.0a4","v1.3.0a3","v1.3.0a2","v1.3.0a1","v1.2.3","v1.2.3rc1","v1.2.3a1","v1.2.2"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-58389.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N"}]}