PatchTheCVECVE-2025-61166: An open redirect in Ascertia SigningHub User v10.0 allows attackers to redirect users to a malicious site via
28
Routine
MEDIUM 6.1DOWNGRADE
CVE-2025-61166 is a medium-severity flaw (CVSS 6.1) affecting signinghub. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
An open redirect in Ascertia SigningHub User v10.0 allows attackers to redirect users to a malicious site via a crafted URL.
Why this priority
- Public exploit reference
No fix is published yet: follow the downgrade or mitigation steps.
Risk facts
| CVSS score | 6.1 (Medium) |
| Attack vector | Network (remote) |
| Attack complexity | Low |
| Privileges needed | None |
| User interaction | Required |
| EPSS exploit chance | 0.2% (top 93%) |
| CISA exploited list | No |
| Weakness | CWE-601 |
| Published | 2026-04-06 |
| Last modified | 2026-10-23 |
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
ascertia signinghub DOWNGRADE
Affected: 8.6.8 · 10.0
Fixed in: no fixed release known
Safe to downgrade to: a release before 8.6.8
1. Check installed version
apt-cache policy signinghub || rpm -q signinghub || signinghub --version
2. No fixed release: DOWNGRADE to a release before 8.6.8 (Debian / Ubuntu)
apt-cache madison signinghub
sudo apt install signinghub=<VERSION_BEFORE_8.6.8>
sudo apt-mark hold signinghub
2. No fixed release: DOWNGRADE (RHEL / Amazon Linux / Fedora)
dnf --showduplicates list signinghub
sudo dnf downgrade signinghub-<VERSION_BEFORE_8.6.8>
sudo dnf versionlock add signinghub
Downgrade risk
Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.
After downgrade
Restart the service, and keep the package held until a fixed release ships.
Verify at the official source NVD · CVE Program · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.