CWE-601
AllowedURL Redirection to Untrusted Site ('Open Redirect')
Abstraction: Base · Status: Draft
The web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a redirect.
2585 vulnerabilities reference this CWE, most recent first.
GHSA-H2F9-84PG-6VJ7
Vulnerability from github – Published: 2025-10-06 12:30 – Updated: 2026-06-06 09:31URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Logo Software Inc. Logo Cloud allows Phishing, Forceful Browsing.This issue affects Logo Cloud: before 2025.R6.
{
"affected": [],
"aliases": [
"CVE-2025-0608"
],
"database_specific": {
"cwe_ids": [
"CWE-601"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-10-06T10:15:33Z",
"severity": "MODERATE"
},
"details": "URL Redirection to Untrusted Site (\u0027Open Redirect\u0027) vulnerability in Logo Software Inc. Logo Cloud allows Phishing, Forceful Browsing.This issue affects Logo Cloud: before 2025.R6.",
"id": "GHSA-h2f9-84pg-6vj7",
"modified": "2026-06-06T09:31:14Z",
"published": "2025-10-06T12:30:30Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-0608"
},
{
"type": "WEB",
"url": "https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-25-0318"
},
{
"type": "WEB",
"url": "https://www.usom.gov.tr/bildirim/tr-25-0318"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L",
"type": "CVSS_V3"
}
]
}
GHSA-H2GW-C5HC-PQGM
Vulnerability from github – Published: 2026-09-15 21:32 – Updated: 2026-09-15 21:32Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component: Administration). Supported versions that are affected are 8.2.0.0.0, 12.2.1.4.0 and 26.01.0.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle BI Publisher. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle BI Publisher, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle BI Publisher accessible data as well as unauthorized update, insert or delete access to some of Oracle BI Publisher accessible data. CVSS 3.1 Base Score 7.6 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N).
{
"affected": [],
"aliases": [
"CVE-2026-83320"
],
"database_specific": {
"cwe_ids": [
"CWE-601"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-09-15T20:18:45Z",
"severity": "HIGH"
},
"details": "Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component: Administration). Supported versions that are affected are 8.2.0.0.0, 12.2.1.4.0 and 26.01.0.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle BI Publisher. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle BI Publisher, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle BI Publisher accessible data as well as unauthorized update, insert or delete access to some of Oracle BI Publisher accessible data. CVSS 3.1 Base Score 7.6 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N).",
"id": "GHSA-h2gw-c5hc-pqgm",
"modified": "2026-09-15T21:32:33Z",
"published": "2026-09-15T21:32:33Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-83320"
},
{
"type": "WEB",
"url": "https://www.oracle.com/security-alerts/cspusep2026.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-H3GX-584X-JXW5
Vulnerability from github – Published: 2023-12-19 21:32 – Updated: 2026-04-28 21:33URL Redirection to Untrusted Site ('Open Redirect') vulnerability in CRM Perks Integration for Salesforce and Contact Form 7, WPForms, Elementor, Ninja Forms.This issue affects Integration for Salesforce and Contact Form 7, WPForms, Elementor, Ninja Forms: from n/a through 1.3.3.
{
"affected": [],
"aliases": [
"CVE-2023-37982"
],
"database_specific": {
"cwe_ids": [
"CWE-601"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-12-19T21:15:07Z",
"severity": "MODERATE"
},
"details": "URL Redirection to Untrusted Site (\u0027Open Redirect\u0027) vulnerability in CRM Perks Integration for Salesforce and Contact Form 7, WPForms, Elementor, Ninja Forms.This issue affects Integration for Salesforce and Contact Form 7, WPForms, Elementor, Ninja Forms: from n/a through 1.3.3.",
"id": "GHSA-h3gx-584x-jxw5",
"modified": "2026-04-28T21:33:26Z",
"published": "2023-12-19T21:32:20Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-37982"
},
{
"type": "WEB",
"url": "https://patchstack.com/database/vulnerability/cf7-salesforce/wordpress-integration-for-contact-form-7-and-salesforce-plugin-1-3-3-open-redirection-vulnerability?_s_id=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-H3JC-PWM8-8FVH
Vulnerability from github – Published: 2026-06-19 18:32 – Updated: 2026-07-09 18:31The GridTime 3000 GNSS Time Server has an open redirect vulnerability in the password change form submission.
This issue affects GridTime 3000: from 1.0r0.03 through 1.1r0.0.
{
"affected": [],
"aliases": [
"CVE-2026-12622"
],
"database_specific": {
"cwe_ids": [
"CWE-601"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-06-19T16:16:17Z",
"severity": "MODERATE"
},
"details": "The GridTime 3000 GNSS Time Server has an open redirect vulnerability in the password change form submission.\n\nThis issue affects GridTime 3000: from 1.0r0.03 through 1.1r0.0.",
"id": "GHSA-h3jc-pwm8-8fvh",
"modified": "2026-07-09T18:31:23Z",
"published": "2026-06-19T18:32:32Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-12622"
},
{
"type": "WEB",
"url": "https://www.microchip.com/en-us/solutions/technologies/embedded-security/how-to-report-potential-product-security-vulnerabilities/gridtime-3000-gnss-time-server-open-redirect"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-H3QP-GQRC-Q736
Vulnerability from github – Published: 2026-06-09 06:31 – Updated: 2026-07-30 18:06A Spring MVC or Spring WebFlux application which configures a mapping for "/**" where the view name is not explicitly specified allows an attacker to craft a link resulting in a 302 redirect to an arbitrary external host via the redirect: prefix.
Affected versions: Spring Framework 7.0.0 through 7.0.7; 6.2.0 through 6.2.18; 6.1.0 through 6.1.27; 5.3.0 through 5.3.48.
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 7.0.7"
},
"package": {
"ecosystem": "Maven",
"name": "org.springframework:spring-webmvc"
},
"ranges": [
{
"events": [
{
"introduced": "7.0.0"
},
{
"fixed": "7.0.8"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 7.0.7"
},
"package": {
"ecosystem": "Maven",
"name": "org.springframework:spring-webflux"
},
"ranges": [
{
"events": [
{
"introduced": "7.0.0"
},
{
"fixed": "7.0.8"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 6.2.18"
},
"package": {
"ecosystem": "Maven",
"name": "org.springframework:spring-webmvc"
},
"ranges": [
{
"events": [
{
"introduced": "6.2.0"
},
{
"fixed": "6.2.19"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 6.2.18"
},
"package": {
"ecosystem": "Maven",
"name": "org.springframework:spring-webflux"
},
"ranges": [
{
"events": [
{
"introduced": "6.2.0"
},
{
"fixed": "6.2.19"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Maven",
"name": "org.springframework:spring-webmvc"
},
"ranges": [
{
"events": [
{
"introduced": "6.1.0"
},
{
"last_affected": "6.1.21"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Maven",
"name": "org.springframework:spring-webflux"
},
"ranges": [
{
"events": [
{
"introduced": "6.1.0"
},
{
"last_affected": "6.1.21"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Maven",
"name": "org.springframework:spring-webmvc"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "5.3.39"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Maven",
"name": "org.springframework:spring-webflux"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "5.3.39"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-41844"
],
"database_specific": {
"cwe_ids": [
"CWE-601"
],
"github_reviewed": true,
"github_reviewed_at": "2026-07-30T18:06:56Z",
"nvd_published_at": "2026-06-09T05:16:36Z",
"severity": "MODERATE"
},
"details": "A Spring MVC or Spring WebFlux application which configures a mapping for \"/**\" where the view name is not explicitly specified allows an attacker to craft a link resulting in a 302 redirect to an arbitrary external host via the redirect: prefix.\n\nAffected versions:\nSpring Framework 7.0.0 through 7.0.7; 6.2.0 through 6.2.18; 6.1.0 through 6.1.27; 5.3.0 through 5.3.48.",
"id": "GHSA-h3qp-gqrc-q736",
"modified": "2026-07-30T18:06:56Z",
"published": "2026-06-09T06:31:57Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41844"
},
{
"type": "WEB",
"url": "https://github.com/spring-projects/spring-framework/commit/3aaec987651cf82fd4ed7e0ed9b3deddcdf58853"
},
{
"type": "WEB",
"url": "https://github.com/spring-projects/spring-framework/commit/7add5243b9db13a9f8e765c8ab8545c8e8fe606b"
},
{
"type": "PACKAGE",
"url": "https://github.com/spring-projects/spring-framework"
},
{
"type": "WEB",
"url": "https://github.com/spring-projects/spring-framework/releases/tag/v6.2.19"
},
{
"type": "WEB",
"url": "https://github.com/spring-projects/spring-framework/releases/tag/v7.0.8"
},
{
"type": "WEB",
"url": "https://spring.io/security/cve-2026-41844"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N",
"type": "CVSS_V3"
}
],
"summary": "Spring Framework Open Redirect in Spring MVC and WebFlux"
}
GHSA-H46V-WCXP-Q8JP
Vulnerability from github – Published: 2026-09-30 00:32 – Updated: 2026-10-01 21:32URL redirection to untrusted site ('open redirect') vulnerability in The Wikimedia Foundation Mediawiki - Collection extension allows Fake the Source of Data.
This issue affects Mediawiki - Collection extension: before 1.46.1, 1.45.5, 1.43.10.
{
"affected": [],
"aliases": [
"CVE-2026-103048"
],
"database_specific": {
"cwe_ids": [
"CWE-601"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-09-30T00:16:35Z",
"severity": "MODERATE"
},
"details": "URL redirection to untrusted site (\u0027open redirect\u0027) vulnerability in The Wikimedia Foundation Mediawiki - Collection extension allows Fake the Source of Data.\n\nThis issue affects Mediawiki - Collection extension: before 1.46.1, 1.45.5, 1.43.10.",
"id": "GHSA-h46v-wcxp-q8jp",
"modified": "2026-10-01T21:32:46Z",
"published": "2026-09-30T00:32:47Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-103048"
},
{
"type": "WEB",
"url": "https://gerrit.wikimedia.org/r/c/1346083"
},
{
"type": "WEB",
"url": "https://phabricator.wikimedia.org/T321092"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-H49C-XWW8-55FJ
Vulnerability from github – Published: 2022-05-14 02:02 – Updated: 2022-05-14 02:02An issue was discovered in BTITeam XBTIT. The "returnto" parameter of the login page is vulnerable to an open redirect due to a lack of validation. If a user is already logged in when accessing the page, they will be instantly redirected.
{
"affected": [],
"aliases": [
"CVE-2018-15683"
],
"database_specific": {
"cwe_ids": [
"CWE-601"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2018-09-05T21:29:00Z",
"severity": "MODERATE"
},
"details": "An issue was discovered in BTITeam XBTIT. The \"returnto\" parameter of the login page is vulnerable to an open redirect due to a lack of validation. If a user is already logged in when accessing the page, they will be instantly redirected.",
"id": "GHSA-h49c-xww8-55fj",
"modified": "2022-05-14T02:02:05Z",
"published": "2022-05-14T02:02:05Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-15683"
},
{
"type": "WEB",
"url": "https://rastating.github.io/xbtit-multiple-vulnerabilities"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-H4HV-M4H4-MHWG
Vulnerability from github – Published: 2019-01-04 17:50 – Updated: 2024-09-18 14:44A maliciously crafted URL to a Django (1.10 before 1.10.7, 1.9 before 1.9.13, and 1.8 before 1.8.18) site using the django.views.static.serve() view could redirect to any other domain, aka an open redirect vulnerability.
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "Django"
},
"ranges": [
{
"events": [
{
"introduced": "1.10"
},
{
"fixed": "1.10.7"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "PyPI",
"name": "Django"
},
"ranges": [
{
"events": [
{
"introduced": "1.9"
},
{
"fixed": "1.9.13"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "PyPI",
"name": "Django"
},
"ranges": [
{
"events": [
{
"introduced": "1.8"
},
{
"fixed": "1.8.18"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2017-7234"
],
"database_specific": {
"cwe_ids": [
"CWE-601"
],
"github_reviewed": true,
"github_reviewed_at": "2020-06-16T21:38:44Z",
"nvd_published_at": null,
"severity": "MODERATE"
},
"details": "A maliciously crafted URL to a Django (1.10 before 1.10.7, 1.9 before 1.9.13, and 1.8 before 1.8.18) site using the `django.views.static.serve()` view could redirect to any other domain, aka an open redirect vulnerability.",
"id": "GHSA-h4hv-m4h4-mhwg",
"modified": "2024-09-18T14:44:05Z",
"published": "2019-01-04T17:50:17Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-7234"
},
{
"type": "WEB",
"url": "https://github.com/django/django/commit/2a9f6ef71b8e23fd267ee2be1be26dde8ab67037"
},
{
"type": "WEB",
"url": "https://github.com/django/django/commit/4a6b945dffe8d10e7cec107d93e6efaebfbded29"
},
{
"type": "WEB",
"url": "https://github.com/django/django/commit/5f1ffb07afc1e59729ce2b283124116d6c0659e4"
},
{
"type": "ADVISORY",
"url": "https://github.com/advisories/GHSA-h4hv-m4h4-mhwg"
},
{
"type": "PACKAGE",
"url": "https://github.com/django/django"
},
{
"type": "WEB",
"url": "https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2017-10.yaml"
},
{
"type": "WEB",
"url": "https://web.archive.org/web/20170429023907/http://www.securitytracker.com/id/1038177"
},
{
"type": "WEB",
"url": "https://web.archive.org/web/20170526042328/http://www.securityfocus.com/bid/97401"
},
{
"type": "WEB",
"url": "https://www.djangoproject.com/weblog/2017/apr/04/security-releases"
},
{
"type": "WEB",
"url": "http://www.debian.org/security/2017/dsa-3835"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N",
"type": "CVSS_V4"
}
],
"summary": "Django open redirect"
}
GHSA-H5G6-XMH4-HC37
Vulnerability from github – Published: 2026-07-09 23:19 – Updated: 2026-07-09 23:19Summary
The restrictions on redirect URLs in openrun can be bypassed by attackers, leading to open redirect attacks.
Details
In the current project, the referrer header value is used for subsequent redirects, so there is currently a validation for this redirect value. The current validation logic requires that the host and schema of the redirect URL be the same as the current website's URL, and finally, the path part is used for redirection. This check seems robust, but it can still be bypassed by attackers.
Here's the problem: Assuming the current website is http://127.0.0.1:25222/, if the attacker passes in a redirect URL of http://127.0.0.1:25222//fushuling.com, its host and schema are obviously the same as the current website, thus bypassing the verification. However, the issue lies in the final redirect URL, which is the path part of the URL, i.e., //fushuling.com.
Browsers automatically complete the HTTP header for URLs starting with //, ultimately successfully bypassing the restriction and redirecting to the external address http://fushuling.com.
This vulnerable behavior was successfully reproduced locally. Normally, specifying an external address directly will be blocked, so it will not redirect.
However, if the redirect URL is http://127.0.0.1:25222//fushuling.com, the existing validation logic is bypassed, and the Location header is successfully set to //fushuling.com.
POST /redirecttest/abc/frag HTTP/1.1
Host: 127.0.0.1:25222
Referer: http://127.0.0.1:25222//fushuling.com
Cache-Control: max-age=0
sec-ch-ua: "Not(A:Brand";v="24", "Chromium";v="122"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Windows"
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.57 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Sec-Fetch-Site: none
Sec-Fetch-Mode: navigate
Sec-Fetch-User: ?1
Sec-Fetch-Dest: document
Accept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
Connection: close
Content-Type: application/x-www-form-urlencoded
Content-Length: 0
The user was then successfully redirected to the external address http://fushuling.com.
PoC
http://127.0.0.1:25222//fushuling.com
Impact
Open Redirect
{
"affected": [
{
"package": {
"ecosystem": "Go",
"name": "github.com/openrundev/openrun"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.17.7"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-55252"
],
"database_specific": {
"cwe_ids": [
"CWE-601"
],
"github_reviewed": true,
"github_reviewed_at": "2026-07-09T23:19:39Z",
"nvd_published_at": null,
"severity": "MODERATE"
},
"details": "### Summary\nThe restrictions on redirect URLs in `openrun` can be bypassed by attackers, leading to open redirect attacks.\n\n### Details\n\nIn the current project, the referrer header value is used for subsequent redirects, so there is currently a validation for this redirect value. The current validation logic requires that the host and schema of the redirect URL be the same as the current website\u0027s URL, and finally, the path part is used for redirection. This check seems robust, but it can still be bypassed by attackers.\n\n\u003cimg width=\"1606\" height=\"1346\" alt=\"QQ20260602-140205-2-2\" src=\"https://github.com/user-attachments/assets/83c549f3-38d7-444d-90f0-131d806f67ff\" /\u003e\n\nHere\u0027s the problem: Assuming the current website is `http://127.0.0.1:25222/`, if the attacker passes in a redirect URL of `http://127.0.0.1:25222//fushuling.com`, its host and schema are obviously the same as the current website, thus bypassing the verification. However, the issue lies in the final redirect URL, which is the path part of the URL, i.e., `//fushuling.com`. \n\nBrowsers automatically complete the HTTP header for URLs starting with `//`, ultimately successfully bypassing the restriction and redirecting to the external address `http://fushuling.com`.\n\nThis vulnerable behavior was successfully reproduced locally. Normally, specifying an external address directly will be blocked, so it will not redirect.\n\n\u003cimg width=\"1587\" height=\"717\" alt=\"QQ20260602-140756-2-3\" src=\"https://github.com/user-attachments/assets/51430c42-bd10-401b-9c9f-27a91a0bc648\" /\u003e\n\nHowever, if the redirect URL is `http://127.0.0.1:25222//fushuling.com`, the existing validation logic is bypassed, and the Location header is successfully set to `//fushuling.com`.\n\n```\nPOST /redirecttest/abc/frag HTTP/1.1\nHost: 127.0.0.1:25222\nReferer: http://127.0.0.1:25222//fushuling.com\nCache-Control: max-age=0\nsec-ch-ua: \"Not(A:Brand\";v=\"24\", \"Chromium\";v=\"122\"\nsec-ch-ua-mobile: ?0\nsec-ch-ua-platform: \"Windows\"\nUpgrade-Insecure-Requests: 1\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.57 Safari/537.36\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7\nSec-Fetch-Site: none\nSec-Fetch-Mode: navigate\nSec-Fetch-User: ?1\nSec-Fetch-Dest: document\nAccept-Encoding: gzip, deflate, br\nAccept-Language: zh-CN,zh;q=0.9\nConnection: close\nContent-Type: application/x-www-form-urlencoded\nContent-Length: 0\n\n```\n\u003cimg width=\"1536\" height=\"729\" alt=\"QQ20260602-140925-2-4\" src=\"https://github.com/user-attachments/assets/31fde919-5f90-409f-8b14-af6c9c71761b\" /\u003e\n\nThe user was then successfully redirected to the external address `http://fushuling.com`.\n\n\u003cimg width=\"1692\" height=\"855\" alt=\"QQ20260602-141005-2-5\" src=\"https://github.com/user-attachments/assets/83b43ef6-52fa-4218-908b-7795394ae707\" /\u003e\n\n### PoC\n```\nhttp://127.0.0.1:25222//fushuling.com\n```\n\n### Impact\nOpen Redirect",
"id": "GHSA-h5g6-xmh4-hc37",
"modified": "2026-07-09T23:19:39Z",
"published": "2026-07-09T23:19:39Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/openrundev/openrun/security/advisories/GHSA-h5g6-xmh4-hc37"
},
{
"type": "WEB",
"url": "https://github.com/openrundev/openrun/commit/709da784fcf1311c85f30f3542cfa3601a78bbf0"
},
{
"type": "PACKAGE",
"url": "https://github.com/openrundev/openrun"
},
{
"type": "WEB",
"url": "https://github.com/openrundev/openrun/releases/tag/v0.17.7"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "OpenRun: Redirect URL validation bypass using \u00a0//host\u00a0 paths leads to Open Redirect"
}
GHSA-H5PQ-6H5F-X885
Vulnerability from github – Published: 2022-05-14 03:35 – Updated: 2022-05-14 03:35EMC RSA Archer, versions prior to 6.2.0.8, contains a redirect vulnerability in the QuickLinks feature. A remote attacker may potentially exploit this vulnerability to redirect genuine users to phishing websites with the intent of obtaining sensitive information from the users.
{
"affected": [],
"aliases": [
"CVE-2018-1220"
],
"database_specific": {
"cwe_ids": [
"CWE-601"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2018-03-08T15:29:00Z",
"severity": "MODERATE"
},
"details": "EMC RSA Archer, versions prior to 6.2.0.8, contains a redirect vulnerability in the QuickLinks feature. A remote attacker may potentially exploit this vulnerability to redirect genuine users to phishing websites with the intent of obtaining sensitive information from the users.",
"id": "GHSA-h5pq-6h5f-x885",
"modified": "2022-05-14T03:35:31Z",
"published": "2022-05-14T03:35:31Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-1220"
},
{
"type": "WEB",
"url": "http://seclists.org/fulldisclosure/2018/Mar/12"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/103319"
},
{
"type": "WEB",
"url": "http://www.securitytracker.com/id/1040457"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"type": "CVSS_V3"
}
]
}
Mitigation MIT-5
Strategy: Input Validation
- Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does.
- When performing input validation, consider all potentially relevant properties, including length, type of input, the full range of acceptable values, missing or extra inputs, syntax, consistency across related fields, and conformance to business rules. As an example of business rule logic, "boat" may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as "red" or "blue."
- Do not rely exclusively on looking for malicious or malformed inputs. This is likely to miss at least one undesirable input, especially if the code's environment changes. This can give attackers enough room to bypass the intended validation. However, denylists can be useful for detecting potential attacks or determining which inputs are so malformed that they should be rejected outright.
- Use a list of approved URLs or domains to be used for redirection.
Mitigation
Use an intermediate disclaimer page that provides the user with a clear warning that they are leaving the current site. Implement a long timeout before the redirect occurs, or force the user to click on the link. Be careful to avoid XSS problems (CWE-79) when generating the disclaimer page.
Mitigation MIT-21.2
Strategy: Enforcement by Conversion
- When the set of acceptable objects, such as filenames or URLs, is limited or known, create a mapping from a set of fixed input values (such as numeric IDs) to the actual filenames or URLs, and reject all other inputs.
- For example, ID 1 could map to "/login.asp" and ID 2 could map to "http://www.example.com/". Features such as the ESAPI AccessReferenceMap [REF-45] provide this capability.
Mitigation
Ensure that no externally-supplied requests are honored by requiring that all redirect requests include a unique nonce generated by the application [REF-483]. Be sure that the nonce is not predictable (CWE-330).
Mitigation MIT-6
Strategy: Attack Surface Reduction
- Understand all the potential areas where untrusted inputs can enter your software: parameters or arguments, cookies, anything read from the network, environment variables, reverse DNS lookups, query results, request headers, URL components, e-mail, files, filenames, databases, and any external systems that provide data to the application. Remember that such inputs may be obtained indirectly through API calls.
- Many open redirect problems occur because the programmer assumed that certain inputs could not be modified, such as cookies and hidden form fields.
Mitigation MIT-29
Strategy: Firewall
Use an application firewall that can detect attacks against this weakness. It can be beneficial in cases in which the code cannot be fixed (because it is controlled by a third party), as an emergency prevention measure while more comprehensive software assurance measures are applied, or to provide defense in depth [REF-1481].
CAPEC-178: Cross-Site Flashing
An attacker is able to trick the victim into executing a Flash document that passes commands or calls to a Flash player browser plugin, allowing the attacker to exploit native Flash functionality in the client browser. This attack pattern occurs where an attacker can provide a crafted link to a Flash document (SWF file) which, when followed, will cause additional malicious instructions to be executed. The attacker does not need to serve or control the Flash document. The attack takes advantage of the fact that Flash files can reference external URLs. If variables that serve as URLs that the Flash application references can be controlled through parameters, then by creating a link that includes values for those parameters, an attacker can cause arbitrary content to be referenced and possibly executed by the targeted Flash application.