CVE-2020-5409: Pivotal Software Concourse

Medium severity, CVSS 6.1. EPSS: 0.9% chance of exploitation in the next 30 days.

Pivotal Concourse, most versions prior to 6.0.0, allows redirects to untrusted websites in its login flow. A remote unauthenticated attacker could convince a user to click on a link using the OAuth redirect link with an untrusted website and gain access to that user's access token in Concourse. (This issue is similar to, but distinct from, CVE-2018-15798.)

Affected products

• Pivotal Software Concourse: before 5.2.8 (fixed in 5.2.8); from 5.3.0, before 5.5.10 (fixed in 5.5.10); from 5.6.0, before 5.8.1 (fixed in 5.8.1)

Published 2020-05-14. Last modified 2026-06-17.