CVE-2022-26954: Nopcommerce

Medium severity, CVSS 6.1. EPSS: 0.7% chance of exploitation in the next 30 days.

Multiple open redirect vulnerabilities in NopCommerce 4.10 through 4.50.1 allow remote attackers to conduct phishing attacks by redirecting users to attacker-controlled web sites via the returnUrl parameter, processed by the (1) ChangePassword function, (2) SignInCustomerAsync function, (3) SuccessfulAuthentication method, or (4) NopRedirectResultExecutor class.

Affected products

• Nopcommerce Nopcommerce: from 4.10, before 4.50.2 (fixed in 4.50.2)

Published 2022-10-20. Last modified 2026-06-17.