Medium severity · published Jun 22, 2026
CVE-2026-12863
Open redirect
5.1
CVSS
0.4%
EPSS
No
On KEV
Description
An unvalidated redirect was contained in Venueless' social login functionality and could be exploited for phishing using trusted domains.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 29% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
VE
Venueless · pretix
0.0.0 before d27864a7 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-12863
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-12863
github.com
https://github.com/venueless/venueless/security/advisories/GHSA-m87f-7c4r-w4p3
More from Venueless
7.3
CVE-2026-5599
API allows deletion of users of other instance
7.3
CVE-2026-4982
Unauthorized access to chat contents
6.4
CVE-2026-82838
Default webserver configuration with incorrect CSP
5.1
CVE-2026-12862
XLSX formula injection in exports
2.3
CVE-2026-13350
Permissions where checked incorrectly during room creation, allowing attackers to create rooms of types they shouldn't be allowed to create