A vulnerability has been found in teableio teable up to 1.9.x and classified as problematic. This impacts an unknown function of the file apps/nextjs-app/src/features/auth/pages/LoginPage.tsx of the component Sign-up. The manipulation of the argument redirect leads to cross site scripting.
This vulnerability is uniquely identified as CVE-2026-9566. The attack is possible to be carried out remotely. Moreover, an exploit is present.
The affected component should be upgraded.
The vendor confirms: “The default branch of teableio/teable is develop, and the reported login redirect issue has already been fixed there. The login redirect flow now validates the redirect parameter with isValidRedirectPath() before navigation, which blocks javascript:, data:, and cross-origin redirects.”
