CVE-2026-58450: Invoiceninja

Medium severity, CVSS 4.3. EPSS: 0.3% chance of exploitation in the next 30 days.

Invoice Ninja through 5.13.26 contains an open redirect vulnerability in the client portal login that allows unauthenticated attackers to redirect authenticated victims to attacker-controlled external URLs by injecting a malicious value into the intended query parameter. Attackers can craft a client login link with an external URL in the intended parameter, which is stored in the session without host validation and emitted verbatim via a bare redirect in the ContactLoginController authenticated() handler after the victim completes a legitimate login, enabling phishing attacks.

Affected products

• Invoiceninja Invoiceninja: up to and including 5.13.26

Published 2026-06-30. Last modified 2026-07-14.