CVE-2026-18721 | kalcaddle kodbox 1.67 Build 02 SSO API Login /user/sso/apiLogin callbackUrl redirect

A vulnerability, which was classified as problematic, has been found in kalcaddle kodbox 1.67 Build 02. This issue affects some unknown processing of the file /user/sso/apiLogin of the component SSO API Login. The manipulation of the argument callbackUrl leads to open redirect.

This vulnerability is documented as CVE-2026-18721. The attack can be initiated remotely. Additionally, an exploit exists.

The vendor was contacted early about this disclosure but did not respond in any way.