Vulnerability · Published Aug 20, 2025 · Assigned by GitHub_M

CVE-2025-55751OnboardLite Open Redirect Endpoint

Medium 5.1

In plain English

A medium-severity open redirect in OnboardLite from HackUCF. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 25% of all known vulnerabilities).

Severity (CVSS 4.0)5.1Medium

Exploit odds (30 days)0.3%top 75.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

OnboardLite is the result of the Influx Initiative, our vision for an improved student organization lifecycle at the University of Central Florida. An attacker can craft a link to the trusted application that, when visited, redirects the user to a malicious external site. This enables phishing, credential theft, malware delivery, and trust abuse. Any version with commit hash 6cca19e or later implements jwt signing for the redirect url parameter.

Affected products (as reported)

Vendor	Product	Versions
HackUCF	OnboardLite	< 6cca19ea4f47af125caa08ef82594844f039e07e

Weakness: CWE-601 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N

References

https://github.com/HackUCF/OnboardLite/security/advisories/GHSA-p8c5-qp4c-qr2m x_refsource_CONFIRM
https://github.com/HackUCF/OnboardLite/commit/6cca19ea4f47af125caa08ef82594844f039e07e x_refsource_MISC