We use these services and cookies to improve your user experience. You may opt out if you wish, however, this may limit some features on this site.
Please see our statement on Data Privacy.
The KnowBe4 Security Awareness Training application before 2020-01-10 contains a redirect function that does not validate the destination URL before redirecting. The response has a SCRIPT element that sets window.location.href to an arbitrary https URL.
Reserved 2025-04-20 | Published 2025-04-20 | Updated 2025-04-21 | Assigner mitreCWE-601 URL Redirection to Untrusted Site ('Open Redirect')
www.doyler.net/security-not-included/knowbe4-vulnerabilities
Support options
