CVE-2025-5256 — core
MEDIUMCVE-2025-5256 is a medium-severity (CVSS 5.4) Open Redirect vulnerability in mautic/core. A fix is available for mautic/core — see the affected versions and patch details below.
Mautic has an Open Redirect vulnerability on user unlock path.
Exploitation Status
No confirmed exploitation observed yet
- CISA’s own triage has not observed active exploitation or public proof-of-concept code for this CVE as of its last assessment.
Exploitation and automatability from CISA’s SSVC triage for CVE-2025-5256.
EPSS Exploitation Probability
Probability of exploitation in the next 30 days, from FIRST.org EPSS.
How urgent is this, really
Where this sits among everything scored
Real-World Exposure
mautic/core🐘mautic/core🐘mautic/coreReal-time download stats are indexed for npm and PyPI packages. This vulnerability affects Packagist packages — download data is not available via public APIs for these ecosystems.
Description
Summary
This advisory addresses an Open Redirection vulnerability in Mautic's user unlocking endpoint. This vulnerability could be exploited by an attacker to redirect legitimate users to malicious websites, potentially leading to phishing attacks or the delivery of exploit kits.
Open Redirection via returnUrl Parameter: An Open Redirection vulnerability exists in the /s/action/unlock/user.user/0 endpoint. The returnUrl parameter, intended for post-action redirection, is not properly validated. This allows an attacker to craft a URL that, when clicked by a user, redirects them to an arbitrary external website controlled by the attacker.
Mitigation
Update Mautic to a version that properly validates or sanitizes the returnUrl parameter to ensure that redirects only occur to trusted, internal URLs or explicitly whitelisted domains.
Affected Packages
| Ecosystem | Package | Vulnerable range | Fix |
|---|---|---|---|
| 🐘Packagist | mautic/core | ≥ 1.0.0&&< 4.4.16 | 4.4.16composer require mautic/core:^4.4.16 |
| 🐘Packagist | mautic/core | ≥ 5.0.0-alpha&&< 5.2.6 | 5.2.6composer require mautic/core:^5.2.6 |
| 🐘Packagist | mautic/core | ≥ 6.0.0-alpha&&< 6.0.2 | 6.0.2composer require mautic/core:^6.0.2 |
Detection & mitigation playbook
Open-source dependencyDetect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for mautic/core, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.
Fix
Update mautic/core to 4.4.16 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms CVE-2025-5256 is resolved across your whole dependency graph.
Workarounds
Stop reflecting attacker-controlled destinations: resolve every redirect target against an allowlist of paths or hosts you own, prefer a server-side key over a full URL in the request, and reject absolute URLs entirely where the flow only ever needs a relative one.
Frequently Asked Questions
Is CVE-2025-5256 in your dependencies?
Find it across Packagist, including transitive dependencies.