Vulnerability · Published Dec 1, 2025 · Assigned by GitHub_M
CVE-2025-58044JumpServer has an Open Redirect Vulnerability
Medium 5.5
In plain English
A medium-severity open redirect in jumpserver from jumpserver. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 45% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei.
Official description
JumpServer is an open source bastion host and an operation and maintenance security audit system. Prior to v3.10.19 and v4.10.5, The /core/i18n// endpoint uses the Referer header as the redirection target without proper validation, which could lead to an Open Redirect vulnerability. This vulnerability is fixed in v3.10.19 and v4.10.5.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| jumpserver | jumpserver | < 3.10.19>= 4.0.0, < 4.10.5 |
Weakness: CWE-601 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:L/E:P