CVE-2026-112040

MEDIUM 4.3

diem-project diem Sign-In BasedmUserActions.class.php redirect

CVSS Score

4.3

EPSS Score

0.0%

EPSS Percentile

0th

A vulnerability was determined in diem-project diem up to 116974edfb9a5b8bd69cb13586dc62bcdbb485ad. This affects an unknown part of the file dmCorePlugin/plugins/dmUserPlugin/modules/dmUser/lib/BasedmUserActions.class.php of the component Sign-In. This manipulation of the argument Referer causes open redirect. The attack is possible to be carried out remotely. The exploit has been publicly disclosed and may be utilized. This product adopts a rolling release strategy to maintain continuous delivery. Therefore, version details for affected or updated releases cannot be specified. The project was informed of the problem early through an issue report but has not responded yet.

CWE	CWE-601
Vendor	diem-project
Product	diem
Published	Oct 19, 2026

Stay Ahead of the Next One

Get instant alerts for diem-project diem

Be the first to know when new medium vulnerabilities affecting diem-project diem are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:C

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Scope

Confidentiality

Integrity

Availability

Affected Versions

diem-project / diem

116974edfb9a5b8bd69cb13586dc62bcdbb485ad

References

NVD ↗ CVE.org ↗ EPSS Data ↗

vuldb.com: https://vuldb.com/vuln/421688 vuldb.com: https://vuldb.com/vuln/421688/cti vuldb.com: https://vuldb.com/cve/CVE-2026-112040 vuldb.com: https://vuldb.com/submit/1008083 github.com: https://github.com/diem-project/diem/issues/457 github.com: https://github.com/diem-project/diem/

Credits

🔍 cnluminous (VulDB User) VulDB CNA Team