Application Security · Vulnerability research

How an incomplete patch left a dashboard account takeover open

An earlier fix closed one open redirect, but a second redirect and a client-side path traversal rebuilt the same account takeover chain.

CVE-2025-6023
CVE-2025-6197

insominaSecurity Researcher · Jul 29, 2025 · 1 min read

On this page

The chain

Patch diffing showed the earlier fix validated one route only. A sibling endpoint still redirected to attacker-controlled paths.

CVE	Severity	Finding
CVE-2025-6023	High · 7.6	Open redirect and client-side path traversal chain
CVE-2025-6197	Medium · 4.2	Open redirect in /user/auth-tokens/rotate

Fix

Upgrade to a fixed Grafana release
Restrict who can create dashboards and plugins

Keep Reading

More vulnerability deep dives from Unit 515.

Oct 16, 2026 | IoT & Embedded SecurityChaining a replayed login into full control of a home camerainsominaRead More →Mar 25, 2026 | Network SecurityFrom a lobby account to a switch that will not boot: four Catalyst 9300 CVEsthanhlocpandaRead More →Feb 26, 2026 | Network SecurityTesting public exploit claims for an SSO authentication bypasstheblackturtleRead More →

View all research