CVE-2026-93869: Cotonti

Medium severity, CVSS 6.1. EPSS: 0.4% chance of exploitation in the next 30 days.

Cotonti through 1.0.0 contains an open redirect vulnerability in the cot_url_check() function that validates redirect destinations using a regular expression lacking an end-of-string anchor. Attackers can bypass the redirect guard by supplying hostnames beginning with the site domain to redirect users to attacker-controlled hosts through the ratings plugin or other redirect callers.

Affected products

• Cotonti Cotonti: up to and including 1.0.0

Published 2026-09-18. Last modified 2026-09-22.