Common Weakness Enumeration
CWE-601
Weakness AllowedURL Redirection to Untrusted Site
Abstraction: Base · Status: Draft
The web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a redirect.
Mapping guidance
This CWE entry is at the Base level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.
Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction.
Modes of introduction
Architecture and Design
OMISSION: This weakness is caused by missing a security tactic during the architecture and design phase.
Implementation
Detection methods
Manual Static Analysis
Since this weakness does not typically appear frequently within a single software package, manual white box techniques may be able to provide sufficient code coverage and reduction of false positives if all potentially-vulnerable operations can be assessed within limited time constraints.
Effectiveness: High
Automated Dynamic Analysis
Automated black box tools that supply URLs to every input may be able to spot Location header modifications, but test case coverage is a factor, and custom redirects may not be detected.
Automated Static Analysis
Automated static analysis tools may not be able to determine whether input influences the beginning of a URL, which is important for reducing false positives.
Automated Static Analysis
Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input) with "sinks" (destinations where the data interacts with external components, a lower layer such as the OS, etc.)
Effectiveness: High
Automated Static Analysis - Binary or Bytecode
According to SOAR [REF-1479], the following detection techniques may be useful:
Highly cost effective:
Bytecode Weakness Analysis - including disassembler + source code weakness analysis
Binary Weakness Analysis - including disassembler + source code weakness analysis
Effectiveness: High
Dynamic Analysis with Automated Results Interpretation
According to SOAR [REF-1479], the following detection techniques may be useful:
Highly cost effective:
Web Application Scanner
Web Services Scanner
Database Scanners
Effectiveness: High
Dynamic Analysis with Manual Results Interpretation
According to SOAR [REF-1479], the following detection techniques may be useful:
Highly cost effective:
Fuzz Tester
Framework-based Fuzzer
Effectiveness: High
Manual Static Analysis - Source Code
According to SOAR [REF-1479], the following detection techniques may be useful:
Highly cost effective:
Manual Source Code Review (not inspections)
Effectiveness: High
Automated Static Analysis - Source Code
According to SOAR [REF-1479], the following detection techniques may be useful:
Highly cost effective:
Source code Weakness Analyzer
Context-configured Source Code Weakness Analyzer
Effectiveness: High
Architecture or Design Review
According to SOAR [REF-1479], the following detection techniques may be useful:
Highly cost effective:
Formal Methods / Correct-By-Construction
Cost effective for partial coverage:
Inspection (IEEE 1028 standard) (can apply to requirements, design, source code, etc.)
Effectiveness: High
Notes
Other
Whether this issue poses a vulnerability will be subject to the intended behavior of the application. For example, a search engine might intentionally provide redirects to arbitrary URLs.
Content history
Submission: Anonymous Tool Vendor (under NDA)
· 2007-05-07
· CWE Draft 6
Contribution: Michal Biesiada
· 2023-11-25
· CWE 4.18
suggested that CWE include drive-by downloads and contributed references
Modification: Eric Dalci
· Cigital
· 2008-07-01
· CWE 1.0
updated Potential_Mitigations, Time_of_Introduction
Modification: CWE Content Team
· MITRE
· 2008-09-08
· CWE 1.0
updated Alternate_Terms, Background_Details, Description, Detection_Factors, Likelihood_of_Exploit, Name, Relationships, Observed_Example, Taxonomy_Mappings
Modification: CWE Content Team
· MITRE
· 2008-10-03
· CWE 1.1
updated References and Observed_Examples
Modification: CWE Content Team
· MITRE
· 2008-10-14
· CWE 1.0.1
updated Alternate_Terms, Observed_Examples, References
Modification: CWE Content Team
· MITRE
· 2009-03-10
· CWE 1.3
updated Relationships
Modification: CWE Content Team
· MITRE
· 2009-05-27
· CWE 1.4
updated Name
Modification: CWE Content Team
· MITRE
· 2009-12-28
· CWE 1.7
updated Demonstrative_Examples, Detection_Factors, Likelihood_of_Exploit, Potential_Mitigations
Modification: CWE Content Team
· MITRE
· 2010-02-16
· CWE 1.8
updated Applicable_Platforms, Common_Consequences, Detection_Factors, Potential_Mitigations, Related_Attack_Patterns, Relationships, Taxonomy_Mappings
Modification: CWE Content Team
· MITRE
· 2010-04-05
· CWE 1.8.1
updated Demonstrative_Examples
Modification: CWE Content Team
· MITRE
· 2010-06-21
· CWE 1.9
updated Common_Consequences, Potential_Mitigations, References, Relationships
Modification: CWE Content Team
· MITRE
· 2010-09-27
· CWE 1.10
updated Potential_Mitigations
Modification: CWE Content Team
· MITRE
· 2011-06-01
· CWE 1.13
updated Common_Consequences
Modification: CWE Content Team
· MITRE
· 2011-06-27
· CWE 2.0
updated Relationships
Modification: CWE Content Team
· MITRE
· 2011-09-13
· CWE 2.1
updated Potential_Mitigations, References
Modification: CWE Content Team
· MITRE
· 2012-05-11
· CWE 2.2
updated Relationships
Modification: CWE Content Team
· MITRE
· 2012-10-30
· CWE 2.3
updated Potential_Mitigations
Modification: CWE Content Team
· MITRE
· 2013-07-17
· CWE 2.5
updated References, Relationships
Modification: CWE Content Team
· MITRE
· 2014-07-30
· CWE 2.8
updated Detection_Factors, Relationships, Taxonomy_Mappings
Modification: CWE Content Team
· MITRE
· 2015-12-07
· CWE 2.9
updated Relationships
Modification: CWE Content Team
· MITRE
· 2017-11-08
· CWE 3.0
updated Likelihood_of_Exploit, Modes_of_Introduction, References, Relationships, Taxonomy_Mappings
Modification: CWE Content Team
· MITRE
· 2019-01-03
· CWE 3.2
updated Related_Attack_Patterns
Modification: CWE Content Team
· MITRE
· 2019-06-20
· CWE 3.3
updated Relationships, Type
Modification: CWE Content Team
· MITRE
· 2020-02-24
· CWE 4.0
updated Applicable_Platforms, Potential_Mitigations, Relationships
Modification: CWE Content Team
· MITRE
· 2020-06-25
· CWE 4.1
updated Potential_Mitigations
Modification: CWE Content Team
· MITRE
· 2021-10-28
· CWE 4.6
updated Relationships
Modification: CWE Content Team
· MITRE
· 2022-04-28
· CWE 4.7
updated Relationships
Modification: CWE Content Team
· MITRE
· 2022-10-13
· CWE 4.9
updated Observed_Examples
Modification: CWE Content Team
· MITRE
· 2023-01-31
· CWE 4.10
updated Related_Attack_Patterns
Modification: CWE Content Team
· MITRE
· 2023-04-27
· CWE 4.11
updated Description, Detection_Factors, References, Relationships
Modification: CWE Content Team
· MITRE
· 2023-06-29
· CWE 4.12
updated Mapping_Notes
Modification: CWE Content Team
· MITRE
· 2024-02-29
· CWE 4.14
updated Demonstrative_Examples
Modification: CWE Content Team
· MITRE
· 2024-11-19
· CWE 4.16
updated Alternate_Terms, Common_Consequences, Description, Diagram, Other_Notes
Modification: CWE Content Team
· MITRE
· 2025-09-09
· CWE 4.18
updated Alternate_Terms, Common_Consequences, Detection_Factors, Potential_Mitigations, References
Modification: CWE Content Team
· MITRE
· 2025-12-11
· CWE 4.19
updated Applicable_Platforms, Relationships, Weakness_Ordinalities
Modification: CWE Content Team
· MITRE
· 2026-10-28
· CWE 5.0
updated Common_Consequences, Name, Relationships
2729 vulnerabilities reference this CWE, most recent first.
CVE-2026-124556 (GCVE-0-2026-124556)
Vulnerability from cvelistv5 – Published: 2026-11-09 02:15 – Updated: 2026-11-09 02:15
VLAI
EPSS
VEX
Title
kekingcn kkFileView BaseUrlFilter.java BaseUrlFilter.getBaseUrl redirect
Summary
A security vulnerability has been detected in kekingcn kkFileView up to 5.0.3. This issue affects the function BaseUrlFilter.getBaseUrl of the file server/src/main/java/cn/keking/web/filter/BaseUrlFilter.java. The manipulation of the argument X-Base-Url leads to open redirect. The attack is possible to be carried out remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Severity
CWE
- CWE-601 - Open Redirect
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/432888 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/432888/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-124556 | third-party-advisory |
| https://vuldb.com/submit/1035489 | third-party-advisory |
| https://github.com/kekingcn/kkFileView/security/a… | broken-link |
| https://github.com/kekingcn/kkFileView/ | product |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| kekingcn | kkFileView |
Affected:
5.0.0
Affected: 5.0.1 Affected: 5.0.2 Affected: 5.0.3 cpe:2.3:a:kekingcn:kkfileview:*:*:*:*:*:*:*:* |
{
"containers": {
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:kekingcn:kkfileview:*:*:*:*:*:*:*:*"
],
"product": "kkFileView",
"vendor": "kekingcn",
"versions": [
{
"status": "affected",
"version": "5.0.0"
},
{
"status": "affected",
"version": "5.0.1"
},
{
"status": "affected",
"version": "5.0.2"
},
{
"status": "affected",
"version": "5.0.3"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "lucasg2g (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A security vulnerability has been detected in kekingcn kkFileView up to 5.0.3. This issue affects the function BaseUrlFilter.getBaseUrl of the file server/src/main/java/cn/keking/web/filter/BaseUrlFilter.java. The manipulation of the argument X-Base-Url leads to open redirect. The attack is possible to be carried out remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 5,
"vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N/E:POC/RL:ND/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-601",
"description": "Open Redirect",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-09T02:15:25.557Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-432888 | kekingcn kkFileView BaseUrlFilter.java BaseUrlFilter.getBaseUrl redirect",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/432888"
},
{
"name": "VDB-432888 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/432888/cti"
},
{
"name": "CVE-2026-124556 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-124556"
},
{
"name": "Submit #1035489 | kekingcn kkFileView v5.0.2 (reviewed release commit `c4288f7e`, official-baseline jar `server/target/kkFileView-5.0.2.jar`); the `X-Base-Url` header precedence has been in place since 2021 and the same filter pair is still present on upstream `main` URL r",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/1035489"
},
{
"tags": [
"broken-link"
],
"url": "https://github.com/kekingcn/kkFileView/security/advisories/GHSA-wrm9-r4fj-f8q5"
},
{
"tags": [
"product"
],
"url": "https://github.com/kekingcn/kkFileView/"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-11-08T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-11-08T01:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-11-08T15:18:56.000Z",
"value": "VulDB entry last update"
}
],
"title": "kekingcn kkFileView BaseUrlFilter.java BaseUrlFilter.getBaseUrl redirect",
"x_generator": [
"VulDB PVTS v202611"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-124556",
"datePublished": "2026-11-09T02:15:25.557Z",
"dateReserved": "2026-11-08T14:13:51.633Z",
"dateUpdated": "2026-11-09T02:15:25.557Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-124505 (GCVE-0-2026-124505)
Vulnerability from cvelistv5 – Published: 2026-11-09 00:30 – Updated: 2026-11-09 00:30
VLAI
EPSS
VEX
Title
Dianping CAT Login/Logout Handler.java Handler.redirect
Summary
A flaw has been found in Dianping CAT 3.0.0/3.1.0/4.0-RC1. This affects the function Handler.redirect of the file Handler.java of the component Login/Logout. Executing a manipulation of the argument rtnUrl can lead to open redirect. The attack may be performed from remote. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Severity
CWE
- CWE-601 - Open Redirect
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/432809 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/432809/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-124505 | third-party-advisory |
| https://vuldb.com/submit/1035480 | third-party-advisory |
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:dianping:cat:*:*:*:*:*:*:*:*"
],
"modules": [
"Login/Logout"
],
"product": "CAT",
"vendor": "Dianping",
"versions": [
{
"status": "affected",
"version": "3.0.0"
},
{
"status": "affected",
"version": "3.1.0"
},
{
"status": "affected",
"version": "4.0-RC1"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "lucasg2g (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A flaw has been found in Dianping CAT 3.0.0/3.1.0/4.0-RC1. This affects the function Handler.redirect of the file Handler.java of the component Login/Logout. Executing a manipulation of the argument rtnUrl can lead to open redirect. The attack may be performed from remote. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 5,
"vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N/E:POC/RL:ND/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-601",
"description": "Open Redirect",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-09T00:30:31.394Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-432809 | Dianping CAT Login/Logout Handler.java Handler.redirect",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/432809"
},
{
"name": "VDB-432809 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/432809/cti"
},
{
"name": "CVE-2026-124505 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-124505"
},
{
"name": "Submit #1035480 | Dianping (Meituan) CAT (Central Application Tracking), module `cat-home` 3.0.0 (released tag, same `redirect()` code) and the 4.0-RC1 development line; reviewed at commit e815e74d4c2dd74edac831241f1253fcc7d25381 URL redirection to untrusted site \u2014 open",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/1035480"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-11-08T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-11-08T01:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-11-08T11:54:09.000Z",
"value": "VulDB entry last update"
}
],
"title": "Dianping CAT Login/Logout Handler.java Handler.redirect",
"x_generator": [
"VulDB PVTS v202611"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-124505",
"datePublished": "2026-11-09T00:30:31.394Z",
"dateReserved": "2026-11-08T10:49:05.033Z",
"dateUpdated": "2026-11-09T00:30:31.394Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-123548 (GCVE-0-2026-123548)
Vulnerability from cvelistv5 – Published: 2026-11-08 01:37 – Updated: 2026-11-08 01:37
VLAI
EPSS
VEX
Title
OpenAM before 16.1.4 Open Redirect via WS-Federation and SAML v2.0 Pages
Summary
OpenIdentityPlatform OpenAM before 16.1.4 contains an open redirect because WS-Federation logout, SAML v2.0 logout and name-identifier management, SAML v2.0 identity provider finder, and some authentication pages do not check destination URLs against allowed lists. Attackers can craft OpenAM-domain links that send users to arbitrary external sites for phishing.
Severity
CWE
- CWE-601 - URL Redirection to Untrusted Site ('Open Redirect')
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/OpenIdentityPlatform/OpenAM/se… | vendor-advisory |
| https://www.vulncheck.com/advisories/openam-befor… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| OpenIdentityPlatform | OpenAM |
Affected:
0 , < 16.1.4
(semver)
Unaffected: 16.1.4 (semver) |
Date Public
2026-10-22 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:maven/org.openidentityplatform.openam/openam-server-only",
"product": "OpenAM",
"vendor": "OpenIdentityPlatform",
"versions": [
{
"lessThan": "16.1.4",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "16.1.4",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"packageURL": "pkg:maven/org.openidentityplatform.openam/openam-federation-library",
"product": "OpenAM",
"vendor": "OpenIdentityPlatform",
"versions": [
{
"lessThan": "16.1.4",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "16.1.4",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:openidentityplatform:openam:*:*:*:*:*:*:*:*",
"versionEndExcluding": "16.1.4",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:openidentityplatform:openam:*:*:*:*:*:*:*:*",
"versionEndExcluding": "16.1.4",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "santhreal"
},
{
"lang": "en",
"type": "remediation developer",
"value": "vharseko"
},
{
"lang": "en",
"type": "remediation reviewer",
"value": "maximthomas"
},
{
"lang": "en",
"type": "remediation reviewer",
"value": "tsujiguchitky"
}
],
"datePublic": "2026-10-22T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "OpenIdentityPlatform OpenAM before 16.1.4 contains an open redirect because WS-Federation logout, SAML v2.0 logout and name-identifier management, SAML v2.0 identity provider finder, and some authentication pages do not check destination URLs against allowed lists. Attackers can craft OpenAM-domain links that send users to arbitrary external sites for phishing."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "HIGH",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 2.3,
"baseSeverity": "LOW",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "LOW",
"subIntegrityImpact": "LOW",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "LOW"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.7,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-601",
"description": "URL Redirection to Untrusted Site (\u0027Open Redirect\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-08T01:37:52.819Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-mgwg-24cx-c8w3)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/OpenIdentityPlatform/OpenAM/security/advisories/GHSA-mgwg-24cx-c8w3"
},
{
"name": "VulnCheck Advisory: OpenAM before 16.1.4 Open Redirect via WS-Federation and SAML v2.0 Pages",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/openam-before-16.1.4-open-redirect-via-ws-federation-and-saml-2.0-pages"
}
],
"title": "OpenAM before 16.1.4 Open Redirect via WS-Federation and SAML v2.0 Pages",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-123548",
"datePublished": "2026-11-08T01:37:52.819Z",
"dateReserved": "2026-11-06T00:49:30.576Z",
"dateUpdated": "2026-11-08T01:37:52.819Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-123547 (GCVE-0-2026-123547)
Vulnerability from cvelistv5 – Published: 2026-11-08 01:37 – Updated: 2026-11-08 01:37
VLAI
EPSS
VEX
Title
OpenAM before 16.1.4 Open Redirect via SAML v2.0 RelayState
Summary
OpenAM before 16.1.4 contains an open redirect vulnerability that allows attackers to redirect users to external sites because RelayState is unchecked when no relayStateUrlList is configured. Attackers can craft single sign-on links with a malicious RelayState to send users from the trusted OpenAM origin to phishing sites and bypass URL filters.
Severity
CWE
- CWE-601 - URL Redirection to Untrusted Site ('Open Redirect')
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/OpenIdentityPlatform/OpenAM/se… | vendor-advisory |
| https://www.vulncheck.com/advisories/openam-befor… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| OpenIdentityPlatform | OpenAM |
Affected:
0 , < 16.1.4
(semver)
Unaffected: 16.1.4 (semver) |
Date Public
2026-10-22 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:maven/org.openidentityplatform.openam/openam-server-only",
"product": "OpenAM",
"vendor": "OpenIdentityPlatform",
"versions": [
{
"lessThan": "16.1.4",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "16.1.4",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"packageURL": "pkg:maven/org.openidentityplatform.openam/openam-federation-library",
"product": "OpenAM",
"vendor": "OpenIdentityPlatform",
"versions": [
{
"lessThan": "16.1.4",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "16.1.4",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:openidentityplatform:openam:*:*:*:*:*:*:*:*",
"versionEndExcluding": "16.1.4",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:openidentityplatform:openam:*:*:*:*:*:*:*:*",
"versionEndExcluding": "16.1.4",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "santhreal"
},
{
"lang": "en",
"type": "remediation developer",
"value": "vharseko"
},
{
"lang": "en",
"type": "remediation reviewer",
"value": "maximthomas"
},
{
"lang": "en",
"type": "remediation reviewer",
"value": "tsujiguchitky"
}
],
"datePublic": "2026-10-22T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "OpenAM before 16.1.4 contains an open redirect vulnerability that allows attackers to redirect users to external sites because RelayState is unchecked when no relayStateUrlList is configured. Attackers can craft single sign-on links with a malicious RelayState to send users from the trusted OpenAM origin to phishing sites and bypass URL filters."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "HIGH",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 2.3,
"baseSeverity": "LOW",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "LOW",
"subIntegrityImpact": "LOW",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "LOW"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.7,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-601",
"description": "URL Redirection to Untrusted Site (\u0027Open Redirect\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-08T01:37:52.076Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-fhqm-62hv-4phw)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/OpenIdentityPlatform/OpenAM/security/advisories/GHSA-fhqm-62hv-4phw"
},
{
"name": "VulnCheck Advisory: OpenAM before 16.1.4 Open Redirect via SAML v2.0 RelayState",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/openam-before-16.1.4-open-redirect-via-saml-2.0-relaystate"
}
],
"title": "OpenAM before 16.1.4 Open Redirect via SAML v2.0 RelayState",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-123547",
"datePublished": "2026-11-08T01:37:52.076Z",
"dateReserved": "2026-11-06T00:49:30.575Z",
"dateUpdated": "2026-11-08T01:37:52.076Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-123541 (GCVE-0-2026-123541)
Vulnerability from cvelistv5 – Published: 2026-11-08 01:37 – Updated: 2026-11-08 01:37
VLAI
EPSS
VEX
Title
OpenAM before 16.1.4 Open Redirect via SAML 1.x Trusted-Partner Matching
Summary
OpenAM before 16.1.4 contains an open redirect vulnerability that allows remote attackers to redirect users after SAML 1.x single sign-on by exploiting loose trusted-partner destination matching. Attackers can craft links to /SAMLAwareServlet or /SAMLPOSTProfileServlet with a destination host resembling a trusted partner to send authenticated users to attacker-controlled phishing sites.
Severity
4.7 (Medium)
CWE
- CWE-601 - URL Redirection to Untrusted Site ('Open Redirect')
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/OpenIdentityPlatform/OpenAM/se… | vendor-advisory |
| https://www.vulncheck.com/advisories/openam-befor… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| OpenIdentityPlatform | OpenAM |
Affected:
0 , < 16.1.4
(semver)
Unaffected: 16.1.4 (semver) cpe:2.3:a:openidentityplatform:openam:*:*:*:*:*:*:*:* |
Date Public
2026-10-22 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:maven/org.openidentityplatform.openam/openam-federation-library",
"product": "OpenAM",
"vendor": "OpenIdentityPlatform",
"versions": [
{
"lessThan": "16.1.4",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "16.1.4",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:openidentityplatform:openam:*:*:*:*:*:*:*:*",
"versionEndExcluding": "16.1.4",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "qurb4n01"
},
{
"lang": "en",
"type": "remediation developer",
"value": "vharseko"
},
{
"lang": "en",
"type": "remediation reviewer",
"value": "maximthomas"
},
{
"lang": "en",
"type": "remediation reviewer",
"value": "tsujiguchitky"
}
],
"datePublic": "2026-10-22T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "OpenAM before 16.1.4 contains an open redirect vulnerability that allows remote attackers to redirect users after SAML 1.x single sign-on by exploiting loose trusted-partner destination matching. Attackers can craft links to /SAMLAwareServlet or /SAMLPOSTProfileServlet with a destination host resembling a trusted partner to send authenticated users to attacker-controlled phishing sites."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "LOW",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.7,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-601",
"description": "URL Redirection to Untrusted Site (\u0027Open Redirect\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-08T01:37:47.953Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-rw43-r238-4c7j)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/OpenIdentityPlatform/OpenAM/security/advisories/GHSA-rw43-r238-4c7j"
},
{
"name": "VulnCheck Advisory: OpenAM before 16.1.4 Open Redirect via SAML 1.x Trusted-Partner Matching",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/openam-before-16.1.4-open-redirect-via-saml-1-x-trusted-partner-matching"
}
],
"title": "OpenAM before 16.1.4 Open Redirect via SAML 1.x Trusted-Partner Matching",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-123541",
"datePublished": "2026-11-08T01:37:47.953Z",
"dateReserved": "2026-11-06T00:48:46.279Z",
"dateUpdated": "2026-11-08T01:37:47.953Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-122132 (GCVE-0-2026-122132)
Vulnerability from cvelistv5 – Published: 2026-11-04 20:36 – Updated: 2026-11-05 19:41
VLAI
EPSS
VEX
Title
go-chi chi 5.2.2 through 5.5.0 Open Redirect via RedirectSlashes Middleware
Summary
go-chi chi 5.2.2 through 5.5.0 contains an open redirect vulnerability in the RedirectSlashes middleware that allows attackers to redirect victims to external hosts by embedding tab characters in request paths. Attackers can craft links with a URL-encoded tab, which browsers strip from the 301 Location header and resolve as a protocol-relative URL, bypassing the fix for CVE-2025-69725.
Severity
6.1 (Medium)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-05 19:40 UTC
CWE
- CWE-601 - URL Redirection to Untrusted Site ('Open Redirect')
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/go-chi/chi/pull/1238 | issue-trackingpatch |
| https://github.com/go-chi/chi | product |
| https://github.com/go-chi/chi/security/advisories… | relatedvendor-advisory |
| https://github.com/go-chi/chi/blob/v5.5.0/middlew… | technical-description |
| https://www.vulncheck.com/advisories/go-chi-chi-5… | third-party-advisory |
Date Public
2026-10-23 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-122132",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-05T19:40:43.390519Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-05T19:41:43.032Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/go-chi/chi/security/advisories/GHSA-mqqf-5wvp-8fh8"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:golang/github.com/go-chi/chi/v5",
"product": "chi",
"vendor": "go-chi",
"versions": [
{
"lessThanOrEqual": "5.5.0",
"status": "affected",
"version": "5.2.2",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Zachariah Mithani (AploSec)"
}
],
"datePublic": "2026-10-23T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "go-chi chi 5.2.2 through 5.5.0 contains an open redirect vulnerability in the RedirectSlashes middleware that allows attackers to redirect victims to external hosts by embedding tab characters in request paths. Attackers can craft links with a URL-encoded tab, which browsers strip from the 301 Location header and resolve as a protocol-relative URL, bypassing the fix for CVE-2025-69725."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.1,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "ACTIVE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "LOW"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-601",
"description": "URL Redirection to Untrusted Site (\u0027Open Redirect\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-04T20:36:51.758Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "Pull Request #1238",
"tags": [
"issue-tracking",
"patch"
],
"url": "https://github.com/go-chi/chi/pull/1238"
},
{
"tags": [
"product"
],
"url": "https://github.com/go-chi/chi"
},
{
"name": "GitHub Security Advisory (GHSA-mqqf-5wvp-8fh8)",
"tags": [
"related",
"vendor-advisory"
],
"url": "https://github.com/go-chi/chi/security/advisories/GHSA-mqqf-5wvp-8fh8"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/go-chi/chi/blob/v5.5.0/middleware/strip.go#L41-L69"
},
{
"name": "VulnCheck Advisory: go-chi chi 5.2.2 through 5.5.0 Open Redirect via RedirectSlashes Middleware",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/go-chi-chi-5.2.2-through-5.5.0-open-redirect-via-redirectslashes-middleware"
}
],
"title": "go-chi chi 5.2.2 through 5.5.0 Open Redirect via RedirectSlashes Middleware",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-122132",
"datePublished": "2026-11-04T20:36:51.758Z",
"dateReserved": "2026-11-04T18:13:11.154Z",
"dateUpdated": "2026-11-05T19:41:43.032Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-121825 (GCVE-0-2026-121825)
Vulnerability from cvelistv5 – Published: 2026-11-09 02:58 – Updated: 2026-11-09 02:58
VLAI
EPSS
VEX
Title
Open redirect in the Liberty ID-FF service provider single sign-on flow
Summary
OpenAM (OpenAM Consortium Edition) 14.0.5 and earlier contains an open redirect vulnerability (CWE-601) in the Liberty ID-FF service provider single sign-on flow. The goto parameter of the /preLogin endpoint is stored as the RelayState of the Liberty ID-FF authentication request without validation, and after the user completes single sign-on at the identity provider, the assertion consumer service redirects the browser to that value. A remote unauthenticated attacker can induce a user to access a crafted URL and, after the user authenticates, redirect the user to an arbitrary website, which may be used for phishing. Only deployments in which a Liberty ID-FF hosted service provider is configured are affected; Liberty ID-FF is not configured by default. This issue is fixed in 14.0.6, which disables the legacy Liberty ID-FF endpoints.
Severity
6.1 (Medium)
CWE
- CWE-601 - URL Redirection to Untrusted Site ('Open Redirect')
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://openam-jp.github.io/Advisories/CVE-2026-121825/ | vendor-advisory |
| https://github.com/OpenIdentityPlatform/OpenAM/se… | related |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| OpenAM consortium | OpenAM (OpenAM Consortium Edition) |
Affected:
14.0.0 , < 14.0.6
(semver)
|
{
"containers": {
"cna": {
"affected": [
{
"collectionURL": "https://github.com/openam-jp/openam",
"defaultStatus": "unaffected",
"modules": [
"Liberty ID-FF"
],
"product": "OpenAM (OpenAM Consortium Edition)",
"vendor": "OpenAM consortium",
"versions": [
{
"lessThan": "14.0.6",
"status": "affected",
"version": "14.0.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Arittro Sarkar"
}
],
"descriptions": [
{
"lang": "en",
"value": "OpenAM (OpenAM Consortium Edition) 14.0.5 and earlier contains an open redirect vulnerability (CWE-601) in the Liberty ID-FF service provider single sign-on flow. The goto parameter of the /preLogin endpoint is stored as the RelayState of the Liberty ID-FF authentication request without validation, and after the user completes single sign-on at the identity provider, the assertion consumer service redirects the browser to that value. A remote unauthenticated attacker can induce a user to access a crafted URL and, after the user authenticates, redirect the user to an arbitrary website, which may be used for phishing. Only deployments in which a Liberty ID-FF hosted service provider is configured are affected; Liberty ID-FF is not configured by default. This issue is fixed in 14.0.6, which disables the legacy Liberty ID-FF endpoints."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.1,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "LOW",
"subIntegrityImpact": "LOW",
"userInteraction": "ACTIVE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-601",
"description": "CWE-601: URL Redirection to Untrusted Site (\u0027Open Redirect\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-09T02:58:31.602Z",
"orgId": "37c6977f-aa3f-41e8-829b-3e8ff4df3c14",
"shortName": "openam-jp"
},
"references": [
{
"name": "OpenAM Consortium Security Advisories",
"tags": [
"vendor-advisory"
],
"url": "https://openam-jp.github.io/Advisories/CVE-2026-121825/"
},
{
"name": "OpenIdentityPlatform OpenAM GHSA-5c3q-hp86-xjr8 (Liberty ID-FF RelayState open redirect fixed in 16.1.4)",
"tags": [
"related"
],
"url": "https://github.com/OpenIdentityPlatform/OpenAM/security/advisories/GHSA-5c3q-hp86-xjr8"
}
],
"solutions": [
{
"lang": "en",
"value": "Upgrade to OpenAM (OpenAM Consortium Edition) 14.0.6 or later. Note that 14.0.6 disables the legacy Liberty ID-FF endpoints."
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Open redirect in the Liberty ID-FF service provider single sign-on flow",
"workarounds": [
{
"lang": "en",
"value": "If Liberty ID-FF is not used, remove the Liberty ID-FF servlet mappings (including /preLogin, /IntersiteTransferService and /AssertionConsumerService/*) from WEB-INF/web.xml, or block access to these endpoints at a reverse proxy or web application firewall."
}
]
}
},
"cveMetadata": {
"assignerOrgId": "37c6977f-aa3f-41e8-829b-3e8ff4df3c14",
"assignerShortName": "openam-jp",
"cveId": "CVE-2026-121825",
"datePublished": "2026-11-09T02:58:31.602Z",
"dateReserved": "2026-11-04T05:52:24.036Z",
"dateUpdated": "2026-11-09T02:58:31.602Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-121373 (GCVE-0-2026-121373)
Vulnerability from cvelistv5 – Published: 2026-11-04 12:59 – Updated: 2026-11-04 18:20
VLAI
EPSS
VEX
Title
Symfony: HtmlSanitizer MetaRefreshAttributeSanitizer Matches Only a Narrow Subset of the Browser Refresh Grammar (Incomplete Fix for CVE-2026-48761)
Summary
The Symfony HtmlSanitizer component MetaRefreshAttributeSanitizer, introduced to fix CVE-2026-48761, sanitizes the refresh URL of content attributes of meta tags using a regular expression that is too narrow, allowing sanitization to be bypassed, and resulting in potential URL redirection to untrusted sites in Symfony versions 6.1.x prior to 6.4.50, 7.x prior to 7.4.23, and 8.x prior to 8.1.11.
The shared declarative refresh steps in the WHATWG HTML Standard require a broader approach: the separator after the time may be ASCII whitespace alone, with no ; or ,, and the url= keyword is optional. Directives the browser honours, but the regular expression misses are returned unchanged, so the attacker URL skips UrlSanitizer entirely and both allowLinkSchemes and allowLinkHosts are defeated for the refresh navigation.
This is reachable under any configuration that allows meta with http-equiv and content, including the documented allowStaticElements() preset.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-04 17:49 UTC
CWE
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/symfony/symfony/security/advis… | third-party-advisory |
| https://github.com/symfony/symfony/commit/2d4c4fe… | patch |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| sensiolabs | symfony |
Affected:
6.1.0 , < 6.4.50
(git)
Affected: 7.0.0 , < 7.4.23 (git) Affected: 8.0.0 , < 8.1.11 (git) cpe:2.3:a:sensiolabs:symfony:*:*:*:*:*:*:*:* cpe:2.3:a:sensiolabs:symfony:*:*:*:*:*:*:*:* cpe:2.3:a:sensiolabs:symfony:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-121373",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-04T17:49:00.814730Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-04T18:20:22.620Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://packagist.org/packages/symfony/html-sanitizer",
"defaultStatus": "unaffected",
"modules": [
"Symfony\\Component\\HtmlSanitizer\\Visitor\\AttributeSanitizer\\MetaRefreshAttributeSanitizer"
],
"packageName": "symfony/html-sanitizer",
"product": "symfony",
"repo": "https://github.com/symfony/html-sanitizer",
"vendor": "sensiolabs",
"versions": [
{
"lessThan": "6.4.50",
"status": "affected",
"version": "6.1.0",
"versionType": "git"
},
{
"lessThan": "7.4.23",
"status": "affected",
"version": "7.0.0",
"versionType": "git"
},
{
"lessThan": "8.1.11",
"status": "affected",
"version": "8.0.0",
"versionType": "git"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:sensiolabs:symfony:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.4.50",
"versionStartIncluding": "6.1.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:sensiolabs:symfony:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.4.23",
"versionStartIncluding": "7.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:sensiolabs:symfony:*:*:*:*:*:*:*:*",
"versionEndExcluding": "8.1.11",
"versionStartIncluding": "8.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Ilia Alshanetsky"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Nicolas Grekas"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cdiv\u003eThe Symfony HtmlSanitizer component\u0026nbsp;\u003ccode\u003eMetaRefreshAttributeSanitizer\u003c/code\u003e\u003cspan\u003e, introduced to fix\u0026nbsp;\u003c/span\u003e\u003cspan\u003eCVE-2026-48761\u003c/span\u003e,\u0026nbsp;\u003cspan\u003es\u003c/span\u003e\u003cspan\u003eanitizes\u0026nbsp;\u003c/span\u003e\u003cspan\u003ethe refresh URL of\u0026nbsp;\u003c/span\u003e\u003ccode\u003econtent\u003c/code\u003e\u003cspan\u003e\u0026nbsp;attributes of\u0026nbsp;\u003c/span\u003e\u003ccode\u003emeta\u003c/code\u003e\u003cspan\u003e\u0026nbsp;tags using a regular expression that is too narrow, allowing sanitization to be bypassed, and resulting in potential URL redirection to untrusted sites in Symfony versions 6.1.x prior to\u0026nbsp;\u003c/span\u003e\u003cspan\u003e6.4.50, 7.x prior to 7.4.23, and 8.x prior to 8.1.11.\u003c/span\u003e\u003c/div\u003e\u003cdiv\u003e\u003cspan\u003e\u003cbr\u003e\u003c/span\u003e\u003c/div\u003e\u003cdiv\u003eThe shared declarative refresh steps in the WHATWG HTML Standard\u0026nbsp;require a broader approach: the separator after the time may be ASCII whitespace alone, with no\u0026nbsp;\u003ccode\u003e;\u003c/code\u003e\u0026nbsp;or\u0026nbsp;\u003ccode\u003e,\u003c/code\u003e, and the\u0026nbsp;\u003ccode\u003eurl=\u003c/code\u003e\u0026nbsp;keyword is optional. Directives the browser honours, but the regular expression misses are returned unchanged, so the attacker URL skips\u0026nbsp;\u003ccode\u003eUrlSanitizer\u003c/code\u003e\u0026nbsp;entirely and both\u0026nbsp;\u003ccode\u003eallowLinkSchemes\u003c/code\u003e\u0026nbsp;and\u0026nbsp;\u003ccode\u003eallowLinkHosts\u003c/code\u003e\u0026nbsp;are defeated for the refresh navigation.\u003c/div\u003e\u003cdiv\u003e\u003cbr\u003e\u003c/div\u003e\u003cdiv\u003eThis is reachable under any configuration that allows\u0026nbsp;\u003ccode\u003emeta\u003c/code\u003e\u0026nbsp;with\u0026nbsp;\u003ccode\u003ehttp-equiv\u003c/code\u003e\u0026nbsp;and\u0026nbsp;\u003ccode\u003econtent\u003c/code\u003e, including the documented\u0026nbsp;\u003ccode\u003eallowStaticElements()\u003c/code\u003e\u0026nbsp;preset.\u003c/div\u003e"
}
],
"value": "The Symfony HtmlSanitizer component\u00a0MetaRefreshAttributeSanitizer, introduced to fix\u00a0CVE-2026-48761,\u00a0sanitizes\u00a0the refresh URL of\u00a0content\u00a0attributes of\u00a0meta\u00a0tags using a regular expression that is too narrow, allowing sanitization to be bypassed, and resulting in potential URL redirection to untrusted sites in Symfony versions 6.1.x prior to\u00a06.4.50, 7.x prior to 7.4.23, and 8.x prior to 8.1.11.\n\n\n\n\nThe shared declarative refresh steps in the WHATWG HTML Standard\u00a0require a broader approach: the separator after the time may be ASCII whitespace alone, with no\u00a0;\u00a0or\u00a0,, and the\u00a0url=\u00a0keyword is optional. Directives the browser honours, but the regular expression misses are returned unchanged, so the attacker URL skips\u00a0UrlSanitizer\u00a0entirely and both\u00a0allowLinkSchemes\u00a0and\u00a0allowLinkHosts\u00a0are defeated for the refresh navigation.\n\n\n\n\nThis is reachable under any configuration that allows\u00a0meta\u00a0with\u00a0http-equiv\u00a0and\u00a0content, including the documented\u00a0allowStaticElements()\u00a0preset."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "LOW",
"subIntegrityImpact": "LOW",
"userInteraction": "PASSIVE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-186",
"description": "CWE-186 Overly restrictive regular expression",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-601",
"description": "CWE-601 URL redirection to untrusted site (\u0027open redirect\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-04T18:14:54.592Z",
"orgId": "596c5446-0ce5-4ba2-aa66-48b3b757a647",
"shortName": "Checkmarx"
},
"references": [
{
"tags": [
"third-party-advisory"
],
"url": "https://github.com/symfony/symfony/security/advisories/GHSA-wm2w-4mgj-vw33"
},
{
"tags": [
"patch"
],
"url": "https://github.com/symfony/symfony/commit/2d4c4fe36200858b91132a95076fff3d9de89d26"
}
],
"source": {
"advisory": "GHSA-wm2w-4mgj-vw33",
"discovery": "UNKNOWN"
},
"title": "Symfony: HtmlSanitizer MetaRefreshAttributeSanitizer Matches Only a Narrow Subset of the Browser Refresh Grammar (Incomplete Fix for CVE-2026-48761)",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "596c5446-0ce5-4ba2-aa66-48b3b757a647",
"assignerShortName": "Checkmarx",
"cveId": "CVE-2026-121373",
"datePublished": "2026-11-04T12:59:22.585Z",
"dateReserved": "2026-11-03T11:38:38.187Z",
"dateUpdated": "2026-11-04T18:20:22.620Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-120953 (GCVE-0-2026-120953)
Vulnerability from cvelistv5 – Published: 2026-11-03 18:47 – Updated: 2026-11-03 19:41
VLAI
EPSS
VEX
Title
Atlas SQL JDBC Driver <=4.0.0: OIDC discovery endpoints not scheme-validated - attacker-controlled URI dispatched to OS protocol handler
Summary
A URI redirection weakness exists in the authentication component of the Atlas SQL JDBC Driver. During an interactive sign-in flow the driver accepts endpoint addresses supplied by the remote endpoint it is pointed at without validating their scheme, and passes the resulting address to the local default protocol handler. An unauthenticated remote party that controls the endpoint a user elects to connect to may cause an address of its choosing to be opened on the user's system; user interaction is required.
Severity
4.3 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-03 19:41 UTC
CWE
- CWE-601 - URL Redirection to Untrusted Site ('Open Redirect')
Assigner
References
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| MongoDB | Atlas SQL JDBC Driver |
Affected:
2.1.2 , < 4.0.1
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-120953",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-03T19:41:37.311409Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-03T19:41:48.806Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Atlas SQL JDBC Driver",
"vendor": "MongoDB",
"versions": [
{
"lessThan": "4.0.1",
"status": "affected",
"version": "2.1.2",
"versionType": "semver"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "A URI redirection weakness exists in the authentication component of the Atlas SQL JDBC Driver. During an interactive sign-in flow the driver accepts endpoint addresses supplied by the remote endpoint it is pointed at without validating their scheme, and passes the resulting address to the local default protocol handler. An unauthenticated remote party that controls the endpoint a user elects to connect to may cause an address of its choosing to be opened on the user\u0027s system; user interaction is required."
}
],
"value": "A URI redirection weakness exists in the authentication component of the Atlas SQL JDBC Driver. During an interactive sign-in flow the driver accepts endpoint addresses supplied by the remote endpoint it is pointed at without validating their scheme, and passes the resulting address to the local default protocol handler. An unauthenticated remote party that controls the endpoint a user elects to connect to may cause an address of its choosing to be opened on the user\u0027s system; user interaction is required."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.1,
"baseSeverity": "MEDIUM",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "ACTIVE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-601",
"description": "CWE-601: URL Redirection to Untrusted Site (\u0027Open Redirect\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-03T18:47:36.971Z",
"orgId": "a39b4221-9bd0-4244-95fc-f3e2e07f1deb",
"shortName": "mongodb"
},
"references": [
{
"url": "https://www.mongodb.com/docs/sql-interface/changelog/"
},
{
"url": "https://jira.mongodb.org/browse/SQL-3539"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Atlas SQL JDBC Driver \u003c=4.0.0: OIDC discovery endpoints not scheme-validated - attacker-controlled URI dispatched to OS protocol handler",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "a39b4221-9bd0-4244-95fc-f3e2e07f1deb",
"assignerShortName": "mongodb",
"cveId": "CVE-2026-120953",
"datePublished": "2026-11-03T18:47:36.971Z",
"dateReserved": "2026-11-03T02:56:17.265Z",
"dateUpdated": "2026-11-03T19:41:48.806Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-120638 (GCVE-0-2026-120638)
Vulnerability from cvelistv5 – Published: 2026-11-03 23:40 – Updated: 2026-11-03 23:40
VLAI
EPSS
VEX
Title
CGI versions before 5.00 for Perl allow open redirects via HTML entity decoding of the URL after application validation in redirect
Summary
CGI versions before 5.00 for Perl allow open redirects via HTML entity decoding of the URL after application validation in redirect.
redirect decodes HTML entities in its URL before writing the Location header, so a URL the application has already validated can change meaning. For example, //evil.example/ becomes //evil.example/ and sends the user to another host.
Severity
No CVSS data available.
CWE
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://metacpan.org/release/LEEJO/CGI-4.72/sourc… | technical-description |
| https://metacpan.org/release/LEEJO/CGI-5.00/changes | release-notes |
| https://github.com/leejo/CGI.pm/commit/7733c2753f… | patch |
{
"containers": {
"cna": {
"affected": [
{
"collectionURL": "https://cpan.org/modules",
"defaultStatus": "unaffected",
"modules": [
"CGI"
],
"packageName": "CGI",
"packageURL": "pkg:cpan/CGI",
"programFiles": [
"lib/CGI.pm"
],
"programRoutines": [
{
"name": "CGI::redirect"
}
],
"repo": "https://github.com/leejo/CGI.pm",
"versions": [
{
"lessThan": "5.00",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "CGI versions before 5.00 for Perl allow open redirects via HTML entity decoding of the URL after application validation in redirect.\n\nredirect decodes HTML entities in its URL before writing the Location header, so a URL the application has already validated can change meaning. For example, /\u0026#47;evil.example/ becomes //evil.example/ and sends the user to another host."
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-180",
"description": "CWE-180 Incorrect Behavior Order: Validate Before Canonicalize",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-601",
"description": "CWE-601 URL Redirection to Untrusted Site (\u0027Open Redirect\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-03T23:40:27.142Z",
"orgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
"shortName": "CPANSec"
},
"references": [
{
"tags": [
"technical-description"
],
"url": "https://metacpan.org/release/LEEJO/CGI-4.72/source/lib/CGI.pm"
},
{
"tags": [
"release-notes"
],
"url": "https://metacpan.org/release/LEEJO/CGI-5.00/changes"
},
{
"tags": [
"patch"
],
"url": "https://github.com/leejo/CGI.pm/commit/7733c2753f4f240012097507cda2b6e87ae46db4.patch"
}
],
"solutions": [
{
"lang": "en",
"value": "Upgrade to CGI 5.00 or later."
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "CGI versions before 5.00 for Perl allow open redirects via HTML entity decoding of the URL after application validation in redirect",
"workarounds": [
{
"lang": "en",
"value": "For deployments that cannot upgrade, reject redirect URLs that HTML entity decoding would change."
}
],
"x_generator": {
"engine": "cpansec-cna-tool 0.1"
}
}
},
"cveMetadata": {
"assignerOrgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
"assignerShortName": "CPANSec",
"cveId": "CVE-2026-120638",
"datePublished": "2026-11-03T23:40:27.142Z",
"dateReserved": "2026-11-02T17:40:51.554Z",
"dateUpdated": "2026-11-03T23:40:27.142Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
Mitigation MIT-5
Implementation
Strategy: Input Validation
- Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does.
- When performing input validation, consider all potentially relevant properties, including length, type of input, the full range of acceptable values, missing or extra inputs, syntax, consistency across related fields, and conformance to business rules. As an example of business rule logic, "boat" may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as "red" or "blue."
- Do not rely exclusively on looking for malicious or malformed inputs. This is likely to miss at least one undesirable input, especially if the code's environment changes. This can give attackers enough room to bypass the intended validation. However, denylists can be useful for detecting potential attacks or determining which inputs are so malformed that they should be rejected outright.
- Use a list of approved URLs or domains to be used for redirection.
Mitigation
Architecture and Design
Use an intermediate disclaimer page that provides the user with a clear warning that they are leaving the current site. Implement a long timeout before the redirect occurs, or force the user to click on the link. Be careful to avoid XSS problems (CWE-79) when generating the disclaimer page.
Mitigation MIT-21.2
Architecture and Design
Strategy: Enforcement by Conversion
- When the set of acceptable objects, such as filenames or URLs, is limited or known, create a mapping from a set of fixed input values (such as numeric IDs) to the actual filenames or URLs, and reject all other inputs.
- For example, ID 1 could map to "/login.asp" and ID 2 could map to "http://www.example.com/". Features such as the ESAPI AccessReferenceMap [REF-45] provide this capability.
Mitigation
Architecture and Design
Ensure that no externally-supplied requests are honored by requiring that all redirect requests include a unique nonce generated by the application [REF-483]. Be sure that the nonce is not predictable (CWE-330).
Mitigation MIT-6
Architecture and Design
Implementation
Strategy: Attack Surface Reduction
- Understand all the potential areas where untrusted inputs can enter your software: parameters or arguments, cookies, anything read from the network, environment variables, reverse DNS lookups, query results, request headers, URL components, e-mail, files, filenames, databases, and any external systems that provide data to the application. Remember that such inputs may be obtained indirectly through API calls.
- Many open redirect problems occur because the programmer assumed that certain inputs could not be modified, such as cookies and hidden form fields.
Mitigation MIT-29
Operation
Strategy: Firewall
Use an application firewall that can detect attacks against this weakness. It can be beneficial in cases in which the code cannot be fixed (because it is controlled by a third party), as an emergency prevention measure while more comprehensive software assurance measures are applied, or to provide defense in depth [REF-1481].
CAPEC-178: Cross-Site Flashing
An attacker is able to trick the victim into executing a Flash document that passes commands or calls to a Flash player browser plugin, allowing the attacker to exploit native Flash functionality in the client browser. This attack pattern occurs where an attacker can provide a crafted link to a Flash document (SWF file) which, when followed, will cause additional malicious instructions to be executed. The attacker does not need to serve or control the Flash document. The attack takes advantage of the fact that Flash files can reference external URLs. If variables that serve as URLs that the Flash application references can be controlled through parameters, then by creating a link that includes values for those parameters, an attacker can cause arbitrary content to be referenced and possibly executed by the targeted Flash application.