CVE-2008-6511: Open redirect vulnerability in login.jsp in Openfire 3.6.0a and earlier allows remote attackers to redirect...

Security readout for executives and security teams

Openfire 3.6.0a and earlier allowed its login page to send users to attacker-chosen websites through a URL parameter. This does not directly compromise the server, but it can make phishing more convincing because the link begins on a trusted Openfire host. Exposure is most likely where Openfire 3.6.0a or earlier is still deployed and the login.jsp page is reachable by users or the internet. Internally exposed systems still matter if employees trust the Openfire hostname. Prioritize remediation if legacy Openfire is internet-facing or trusted by staff. The main business risk is credential theft or brand misuse through phishing, not direct infrastructure compromise based on the supplied evidence. Mitigation focus: Check current Openfire vendor guidance for the fixed or supported version.; Upgrade any Openfire 3.6.0a or earlier deployment according to vendor guidance.; Restrict public access to the Openfire login or admin interface where feasible..

Prepared

Jun 28, 2026, 11:04 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.