cve.bz

CWE-601: URL Redirection to Untrusted Site (Open Redirect)

Filter

The web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a redirect.

What the weakness is: CWE-601 at MITRE. OWASP Top 10: A01:2025 Broken Access Control

Related attack patterns (CAPEC): 1
  • CAPEC-178 Cross-Site Flashing Likelihood: Medium · Severity: Medium

The attack patterns MITRE's CAPEC relates to CWE-601, as MITRE names them. Credits.

Ask an AI about CWE-601

ChatGPTClaudeGoogle AI Mode

Show the promptExplain CWE-601: URL Redirection to Untrusted Site and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/601.html and https://cve.bz/cve/cwe/601?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 5.1CVE-2026-122132

    go-chi chi 5.2.2 through 5.5.0 contains an open redirect vulnerability in the RedirectSlashes middleware that allows attackers to redirect victims to external hosts by embedding tab characters in request paths. Attackers can craft links wi…

  2. 3.4CVE-2026-116376

    IBM Db2 Genius Hub 1.1.2, 1.1.3, 1.1.4, 1.1.5 could allow a remote authenticated attacker to conduct a phishing attack due to an open redirect vulnerability.

  3. 5.3CVE-2026-121373

    The Symfony HtmlSanitizer component MetaRefreshAttributeSanitizer, introduced to fix CVE-2026-48761, sanitizes the refresh URL of content attributes of meta tags using a regular expression that is too narrow, allowing sanitization to be by…

  4. –CVE-2026-120638EPSS 0.2%

    CGI versions before 5.00 for Perl allow open redirects via HTML entity decoding of the URL after application validation in redirect. redirect decodes HTML entities in its URL before writing the Location header, so a URL the application ha…

  5. –CVE-2026-120636EPSS 0.2%

    CGI versions before 5.00 for Perl allow open redirects and script injection via URLs built from REQUEST_URI in url and start_form. url(-absolute=>1), url(-relative=>1) and the default start_form action are built from the client-supplied R…

  6. –CVE-2026-120633EPSS 0.1%

    CGI versions before 5.00 for Perl trust the client X-Forwarded-Host header in url, self_url, virtual_host and virtual_port. These take the host name and port from the X-Forwarded-Host request header when present, and otherwise from Host, …

  7. 5.1CVE-2026-111754EPSS 1.0%

    Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.33, 21.2.25, and 22.2.1, ServerPlatformLocation in Angular server-side rendering checks for p…

  8. 5.1CVE-2026-120953EPSS 0.2%

    A URI redirection weakness exists in the authentication component of the Atlas SQL JDBC Driver. During an interactive sign-in flow the driver accepts endpoint addresses supplied by the remote endpoint it is pointed at without validating th…

  9. 5.3CVE-2026-120327EPSS 0.3%

    The click tracking middleware accepts an arbitrary target URL and redirects to it. Attackers can misuse links to the website to redirect users to external sites.

  10. 4.3CVE-2024-12141EPSS 0.2%

    The product fails to sufficiently validate callback URLs, allowing them to be manipulated with malicious payloads when processed through a weak regular expression or when validation is omitted. An attacker can exploit this by crafting a l…

  11. 5.4CVE-2024-2372EPSS 0.2%

    The affected components accept user-supplied input for constructing redirection URLs without enforcing expected validation constraints. This allows an attacker to provide a crafted URL that can redirect users to an arbitrary external domai…

  12. 7.5CVE-2026-107020EPSS 0.6%

    An issue in the activity.LoadLinkLaterActivity component of FeedEx / Handy News Reader versionCode 116 allows attackers to force victim users into fetching a crafted URL.

  13. 6.8CVE-2026-118425EPSS 0.2%

    A flaw was found in the secure-redirect-uris-enforcer client policy of Keycloak, an identity and access management solution. The issue occurs when the policy is configured to allow loopback addresses, as Keycloak resolves hostnames via DNS…

  14. 4.7CVE-2026-118658EPSS 0.2%

    Echo is a Go web framework. Prior to 4.15.2 and 5.1.1, Context.Scheme returns values from X-Forwarded-Proto, X-Forwarded-Protocol, or X-Url-Scheme without validating that they are supported web schemes. WWWRedirect and NonWWWRedirect use t…

  15. 6.1CVE-2026-118656EPSS 0.2%

    Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, sanitizeURI checks only the first two bytes of a redirect target before deciding whether it begins with an absolute-path separator pair. When AddTrailingSlash or RemoveTrailingSlash is…

  16. 4.7CVE-2026-111031EPSS 0.2%

    The Welcart e-Commerce WordPress plugin before 2.12.6 does not validate a user-supplied URL before using it in a redirect, allowing unauthenticated attackers to redirect users to arbitrary external websites.

  17. 7.5CVE-2026-118180EPSS 0.2%

    When logging in to a Matrix account, Thunderbird used the homeserver address provided in the server's login response without validating it. A malicious or compromised homeserver could provide a file: URL, causing Thunderbird to send all fu…

  18. 9.1CVE-2026-118177EPSS 0.2%

    When looking for calendars in a directory on a server, during account setup or when adding a new network calendar, Thunderbird accepted calendar locations pointing to other servers, local files or network shares. A malicious server, or a n…

  19. 7.7CVE-2026-117553EPSS 0.5%

    Umbraco CMS before 17.7.2 and 18.2.2 contains an authentication bypass vulnerability that allows unauthenticated attackers to register attacker-controlled OAuth redirect URIs by poisoning the Host header. Attackers send signed-in users aut…

  20. 2.1CVE-2026-116578EPSS 0.5%

    Tornado is a Python web framework and asynchronous networking library. Prior to 6.6, tornado.web.RedirectHandler URL templates can place regex-capture substitutions where crafted request paths change the redirect scheme or network location…

  21. 6.1CVE-2026-81509EPSS 0.3%

    nforwardauth is a forward auth service that allows the use of a single authentication middleware for multiple sites. Versions prior to 1.5.1 accept an unvalidated `r` query parameter on the `/login` endpoint and use them as the post-authen…

  22. 5.4CVE-2026-115196EPSS 0.3%

    An Open Redirect vulnerability exists in the public form submission endpoint (/form/submit) of Mautic. After a form is submitted, the application redirects the visitor to a return address supplied with the submission without verifying that…

  23. 2.1CVE-2026-115537EPSS 0.3%

    A weakness has been identified in gedelumbung HospitalManagement up to c2d45543789a3887067d3915f69d44cfc2cf76a8. This affects the function simpan of the file application/modules/admin/controllers/routing_pages.php of the component URL Vali…

  24. 3.5CVE-2026-114614EPSS 0.3%

    Authlib is a Python library which builds OAuth and OpenID Connect servers. From 0.13 until 1.8.0, authlib.common.security.is_secure_transport() uses a textual prefix comparison for loopback HTTP exemptions, so a URL whose userinfo begins w…

  25. 5.3CVE-2026-115360EPSS 0.2%

    OpenBao before 2.6.3 contains an open redirect vulnerability in the UI's OIDC identity provider that affects users not authenticated to OpenBao. Attackers can craft OIDC links that redirect unauthenticated users to attacker-controlled dest…

  26. 8.1CVE-2026-51954EPSS 0.6%

    An issue in Webasyst Framework 4.0.3 and before allows a remote attacker to execute arbitrary code via a crafted OAuth authorization URL with an arbitrary redirect_uri.

  27. 5.4CVE-2026-87945EPSS 0.2%

    URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Drupal SAML SSO - Service Provider allows Fake the Source of Data. This issue affects SAML SSO - Service Provider versions: from 0.0.0 to 3.2.0.

  28. 6.5CVE-2026-87937EPSS 0.3%

    URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Drupal Central Authentication System (CAS) Server allows Fake the Source of Data. This issue affects Central Authentication System (CAS) Server versions: from 0.0.0 to 2.…

  29. 5.4CVE-2024-4989EPSS 0.2%

    The callback URL parameter in WSO2 API Manager fails to validate user-supplied input, allowing it to be controlled by malicious actors. Exploitation of this vulnerability could lead to users being redirected to attacker-controlled web pag…

  30. 2.1CVE-2026-114060EPSS 0.2%

    SvelteKit (@sveltejs/kit) before 3.0.0 contains an open redirect vulnerability in enhanced form actions (use:enhance) on routes accepting paths beginning with a double slash. Attackers can craft action paths starting with // that become pr…

  31. 8.8CVE-2026-91579EPSS 0.2%

    Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component: BI Platform Security). Supported versions that are affected are 8.2.0.0.0, 12.2.1.4.0 and 26.01.0.0.0. Easily exploitable vulnerability allows unauthenticat…

  32. 7.8CVE-2026-91549EPSS 0.2%

    Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: Analytics Server). Supported versions that are affected are 8.2.0.0.0 and 12.2.1.4.0. Easily exploitable vulnerability allows un…

  33. 4.7CVE-2026-91526EPSS 0.2%

    Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component: Web Server). Supported versions that are affected are 8.2.0.0.0, 12.2.1.4.0 and 26.01.0.0.0. Difficult to exploit vulnerability allows unauthenticated attac…

  34. 5.4CVE-2026-91455EPSS 0.2%

    Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: E1 Dev Platform Tech - UNIX). Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows unauthenticated …

  35. 4.3CVE-2026-91428EPSS 0.2%

    Vulnerability in the Siebel CRM End User product of Oracle Siebel CRM (component: Open UI). Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP …

  36. 7.8CVE-2026-91328EPSS 0.1%

    Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Deployment SEC). Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows unauthenticated attacker with…

  37. 6.5CVE-2026-91318EPSS 0.3%

    Vulnerability in the Oracle JDeveloper product of Oracle Fusion Middleware (component: Security Framework). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attac…

  38. 8.8CVE-2026-91296EPSS 0.4%

    Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Enterprise Infrastructure SEC). Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows unauthenticate…

  39. 6.5CVE-2026-87407EPSS 0.3%

    Vulnerability in the Oracle Applications Framework product of Oracle E-Business Suite (component: Security). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with ne…

  40. 5.9CVE-2026-101403EPSS 0.3%

    Vulnerability in the Siebel Apps - Marketing product of Oracle Siebel CRM (component: Email Marketing). Supported versions that are affected are 17.0-26.9. Difficult to exploit vulnerability allows unauthenticated attacker with network ac…

  41. 2.1CVE-2026-113384EPSS 0.3%

    A flaw has been found in Optimal IdM OptimalCloud 5.0. This vulnerability affects unknown code of the file /v5.0/social. Executing a manipulation of the argument state can lead to open redirect. The attack can be executed remotely. The ven…

  42. 2.1CVE-2026-112251EPSS 0.3%

    A vulnerability was detected in antoinersx clawhost up to 0.0.45. This affects the function handleRequest of the file apps/clawhostgo/src/main/services/reverseProxy.ts of the component Reverse Proxy. Performing a manipulation of the argume…

  43. 2.1CVE-2026-112040EPSS 0.3%

    A vulnerability was determined in diem-project diem up to 116974edfb9a5b8bd69cb13586dc62bcdbb485ad. This affects an unknown part of the file dmCorePlugin/plugins/dmUserPlugin/modules/dmUser/lib/BasedmUserActions.class.php of the component …

  44. 2.1CVE-2026-112034EPSS 0.3%

    A weakness has been identified in aircheng-org iWebShop-5 up to 5.16. The impacted element is the function IController::redirect of the file plugins/_userInfo/_userInfo.php of the component Login Redirect. This manipulation of the argument…

  45. 5.4CVE-2026-109937EPSS 0.1%

    The Otter Blocks WordPress plugin before 3.2.3 does not validate that a user-supplied return URL belongs to the site before using it to build the return destination of a Stripe Checkout session, allowing unauthenticated attackers to redir…

  46. 5.3CVE-2026-111931EPSS 0.2%

    Coder from 2.0.0 before 2.34.8 contains an open redirect vulnerability in handleAPIKeySmuggling that allows attackers to redirect users externally via unsanitized r.URL.Path values. Attackers can craft links on trusted workspace app subdom…

  47. 5.3CVE-2024-58398EPSS 0.3%

    Coder 2.3.1 before 2.14.4, 2.15.x before 2.15.3, and 2.16.0 before 2.16.1 contains an open redirect vulnerability in the login page because the redirect query parameter is improperly sanitized. Attackers can craft a Coder login URL that, w…

  48. 4.3CVE-2026-92432EPSS 0.2%

    The Patreon WordPress plugin before 1.10.0 does not validate a user-supplied redirect destination before redirecting, allowing unauthenticated attackers to redirect visitors to an arbitrary external URL through a crafted link, which is use…

  49. 7.6CVE-2026-111622EPSS 0.4%

    smart-sso through 2.1.1 contains an open redirect vulnerability in the /login handler that allows unauthenticated attackers to steal OAuth2 authorization codes by supplying an unvalidated redirectUri parameter. Attackers can send crafted /…

  50. 8.6CVE-2026-14452EPSS 0.3%

    Improper validation of the reset_url parameter of the Setup in-page search in Checkmk <2.5.0p15, <2.4.0p38, <2.3.0p51 and 2.2.0 (EOL) allows an attacker to execute arbitrary script in the session of an authenticated user with Setup access,…