Advisory ID: ARKKVM-SA-2026-001
Published: 2026-06-22
Severity: Medium (CVSS v3.1 Score: 6.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
CVE: CVE-YYYY-NNNNN (Pending Assignment)
Summary
A security vulnerability has been identified in the ArkKVM web interface that allows an attacker to perform an open redirect attack. Under certain conditions, this flaw can be elevated to execute arbitrary JavaScript in the context of the ArkKVM web application.
The issue was discovered and responsibly disclosed by security researcher Michał Myśliński. We have investigated the report, implemented a fix, and released an updated version to resolve the risk.
Affected Versions
This vulnerability affects the only two publicly released versions of ArkKVM:
-
0.0.26030108
-
0.1.26050820
Fixed Version
Users are strongly encouraged to upgrade to the latest available release as soon as possible.
Technical Description
The vulnerability resides in the /ad-login page of the ArkKVM web interface.
The application accepted a user-supplied URL via the redirectUrl parameter and utilized it in a DOM-based redirection flow without proper sanitization or validation.
An attacker could exploit this behavior by crafting a malicious link. If a user clicks this link, it could result in:
-
Open Redirect: Redirecting the user from the legitimate ArkKVM interface to an untrusted external website.
-
DOM-based Cross-Site Scripting (XSS): If the parameter contains unsafe URI schemes (e.g., javascript:), arbitrary code could execute within the victim's browser context.
Successful exploitation requires user interaction, such as enticing a target to click a specially crafted URL.
Impact
A successful attack could potentially allow an attacker to:
-
Redirect users to malicious phising websites.
-
Execute attacker-controlled JavaScript within the context of the ArkKVM session.
-
Access sensitive information (such as session tokens or local storage data) available to the current browser session.
Note: No evidence of active exploitation in the wild has been observed.
Remediation
Firmware Upgrade
Users should upgrade to ArkKVM firmware release 0.2.26061815 or later immediately. The fix introduces:
-
Strict validation and whitelisting of redirect destinations (allowing only relative paths or trusted domains).
-
Explicit blocking of unsafe URL schemes (such as javascript:).
-
Additional defense-in-depth hardening of the authentication and post-login redirect flows.
Workarounds
If upgrading immediately is not feasible, users should exercise caution when clicking on hyperlinks to their ArkKVM instances from untrusted or external channels.
Acknowledgements
We would like to thank Michał Myśliński for responsibly reporting this issue and for working collaboratively with us throughout the investigation and remediation process. Responsible disclosure helps protect the ArkKVM ecosystem and benefits the entire community.
References
-
CVE ID: CVE-YYYY-NNNNN (Pending Assignment)
-
CWE-601: URL Redirection to Untrusted Site ('Open Redirect')
-
CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-Site Scripting')
