CVE-2024-58389

MEDIUM 6.1

HoloViz Panel from 1.2.2 before 1.9.0 Open Redirect via next Parameter

CVSS Score

6.1

EPSS Score

0.0%

EPSS Percentile

0th

HoloViz Panel from 1.2.2 before 1.9.0 contains an open redirect vulnerability in panel/auth.py that allows remote attackers to redirect users by supplying an unvalidated next query parameter. BasicLoginHandler and PasswordLoginHandler store the parameter in a next_url cookie, so crafted login links send victims to attacker-controlled external sites after successful login.

CWE	CWE-601
Vendor	holoviz
Product	panel
Published	Oct 12, 2026

Stay Ahead of the Next One

Get instant alerts for holoviz panel

Be the first to know when new medium vulnerabilities affecting holoviz panel are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Affected Versions

HoloViz / Panel

1.2.2 < 1.9.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/holoviz/panel/issues/6782 github.com: https://github.com/holoviz/panel/commit/a6a8b2cb9592a014cf6a7b0d3d5fc9cbf59bb2ed github.com: https://github.com/holoviz/panel/blob/v1.8.10/panel/auth.py#L866-L900 github.com: https://github.com/holoviz/panel vulncheck.com: https://www.vulncheck.com/advisories/holoviz-panel-from-1.2.2-before-1.9.0-open-redirect-via-next-parameter

Credits

Yunus Aydın