{"cve":"CVE-2026-49820","nvd":{"published":"2026-08-13T15:19:41.410","modified":"2026-10-24T16:10:00.153","status":"Deferred","description":"Probo is a self-hostable governance, risk, and compliance (GRC) platform built for engineering and security teams. Probo's `saferedirect` package validates redirect URLs used across authentication flows (OIDC, SAML, session transfer, OAuth connectors, and trust-center magic links). Prior to version 0.19.3.1, the validator only inspected the second character of relative paths, so a URL like `/../\\evil.com` passed validation because the second character is `.`. Go's `http.Redirect` normalizes this path to `/\\evil.com` before setting the `Location` header. Browsers can interpret the backslash as a host separator and redirect the user to an external domain (`https://evil.com`), bypassing the intended same-origin restriction. This enables open-redirect phishing: an attacker can craft a `continue` parameter (or embed a malicious URL in a session-transfer token) that appears to originate from a trusted Probo domain but redirects victims elsewhere. This is fixed in `go.probo.inc/probo` 0.193.1 by normalizing relative paths with `path.Clean` before validation, rejecting backslashes (including percent-encoded `%5c`) anywhere in the path, and re-checking the normalized result for protocol-relative and backslash prefixes. Self-hosted deployments should upgrade to probod v0.194.1 or later. SaaS deployments on getprobo.com are patched. No practical workaround is available for self-hosted installations.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N","score":4.7},"cwes":["CWE-601"],"references":["https://github.com/getprobo/probo/blob/main/SECURITY_NOTES.md","https://github.com/getprobo/probo/security/advisories/GHSA-x7qq-m748-8p2c"],"products":[],"source":"nvd","synced_at":"2026-10-24T16:53:35.584907681+00:00"},"epss":{"cve":"CVE-2026-49820","score":0.00417,"percentile":0.35731,"date":"2026-10-25"},"kev":null,"osv":[{"id":"GHSA-x7qq-m748-8p2c","url":"https://osv.dev/vulnerability/GHSA-x7qq-m748-8p2c","summary":"Probo has an open redirect bypass via path normalization","modified":"2026-07-07T16:11:26.296909694Z","packages":[{"ecosystem":"Go","name":"go.probo.inc/probo","purl":"pkg:golang/go.probo.inc/probo","ranges":["<0.204.0"],"fixed":["0.204.0"]}]},{"id":"GO-2026-5861","url":"https://osv.dev/vulnerability/GO-2026-5861","summary":"Probo has an open redirect bypass via path normalization in go.probo.inc/probo","modified":"2026-07-07T16:01:31.645272537Z","packages":[{"ecosystem":"Go","name":"go.probo.inc/probo","purl":"pkg:golang/go.probo.inc/probo","ranges":["<0.204.0"],"fixed":["0.204.0"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}