CWE-601

{
  "affected": [],
  "aliases": [
    "CVE-2023-23853"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-601"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2023-02-14T04:15:00Z",
    "severity": "MODERATE"
  },
  "details": "An unauthenticated attacker in AP NetWeaver Application Server for ABAP and ABAP Platform - versions 700, 702, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, 789, 790, can craft a link which when clicked by an unsuspecting user can be used to redirect a user to a malicious site which could read or modify some sensitive information or expose the victim to a phishing attack. Vulnerability has no direct impact on availability.",
  "id": "GHSA-jxp4-w2wq-7w9q",
  "modified": "2023-02-21T21:30:18Z",
  "published": "2023-02-14T06:31:25Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-23853"
    },
    {
      "type": "WEB",
      "url": "https://launchpad.support.sap.com/#/notes/3271227"
    },
    {
      "type": "WEB",
      "url": "https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "python-fedora"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.9.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2017-1002150"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-601"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2020-06-16T21:44:34Z",
    "nvd_published_at": "2017-09-14T13:29:00Z",
    "severity": "MODERATE"
  },
  "details": "python-fedora 0.8.0 and lower is vulnerable to an open redirect, resulting in loss of CSRF protection.",
  "id": "GHSA-m242-wc86-8768",
  "modified": "2024-10-25T21:16:44Z",
  "published": "2018-07-13T15:17:05Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-1002150"
    },
    {
      "type": "WEB",
      "url": "https://github.com/fedora-infra/python-fedora/commit/b27f38a67573f4c989710c9bfb726dd4c1eeb929"
    },
    {
      "type": "WEB",
      "url": "https://github.com/fedora-infra/python-fedora/commit/b27f38a67573f4c989710c9bfb726dd4c1eeb929.patch"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/advisories/GHSA-m242-wc86-8768"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/fedora-infra/python-fedora"
    },
    {
      "type": "WEB",
      "url": "https://github.com/pypa/advisory-database/tree/main/vulns/python-fedora/PYSEC-2017-27.yaml"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "python-fedora vulnerable to an open redirect resulting in loss of CSRF protection"
}

{
  "affected": [],
  "aliases": [
    "CVE-2026-3318"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-601"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-05-08T12:16:29Z",
    "severity": "MODERATE"
  },
  "details": "Open redirection vulnerability in the latest demo version of the Cradle eCommerce platform. The vulnerability occurs in the login form endpoint, where the \u2018returnUrl\u2019 parameter allows redirection because the web application accepts a URL as a parameter without properly validating it. As a result, it is possible to redirect users from the legitimate website to external pages. An attacker could exploit this vulnerability to deceive users and redirect them from a trusted URL to a malicious one without their knowledge.",
  "id": "GHSA-m29c-gmm3-c3v9",
  "modified": "2026-05-08T12:31:57Z",
  "published": "2026-05-08T12:31:57Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-3318"
    },
    {
      "type": "WEB",
      "url": "https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-cradle-e-commerce"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2024-6149"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-601"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-07-10T21:15:10Z",
    "severity": "MODERATE"
  },
  "details": "Redirection of users to a vulnerable URL in\u00a0Citrix Workspace app for HTML5",
  "id": "GHSA-m2fx-wq5j-8657",
  "modified": "2025-07-25T15:30:26Z",
  "published": "2024-07-10T21:30:39Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-6149"
    },
    {
      "type": "WEB",
      "url": "https://support.citrix.com/article/CTX678037"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2025-27424"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-601"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-03-04T14:15:39Z",
    "severity": "MODERATE"
  },
  "details": "Websites redirecting to a non-HTTP scheme URL could allow a website address to be spoofed for a malicious page This vulnerability affects Firefox for iOS \u003c 136.",
  "id": "GHSA-m2rp-964h-h237",
  "modified": "2025-03-04T18:33:41Z",
  "published": "2025-03-04T15:31:50Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-27424"
    },
    {
      "type": "WEB",
      "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1945392"
    },
    {
      "type": "WEB",
      "url": "https://www.mozilla.org/security/advisories/mfsa2025-13"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2015-10114"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-601"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2023-06-05T16:15:09Z",
    "severity": "MODERATE"
  },
  "details": "A vulnerability, which was classified as problematic, has been found in WooSidebars Plugin up to 1.4.1 on WordPress. Affected by this issue is the function enable_custom_post_sidebars of the file classes/class-woo-sidebars.php. The manipulation of the argument sendback leads to open redirect. The attack may be launched remotely. Upgrading to version 1.4.2 is able to address this issue. The patch is identified as 1ac6d6ac26e185673f95fc1ccc56a392169ba601. It is recommended to upgrade the affected component. VDB-230654 is the identifier assigned to this vulnerability.",
  "id": "GHSA-m2x7-w5hf-v68g",
  "modified": "2023-06-05T18:30:27Z",
  "published": "2023-06-05T18:30:27Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2015-10114"
    },
    {
      "type": "WEB",
      "url": "https://github.com/wp-plugins/woosidebars/commit/1ac6d6ac26e185673f95fc1ccc56a392169ba601"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/?ctiid.230654"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/?id.230654"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 5.1.5"
      },
      "package": {
        "ecosystem": "npm",
        "name": "@medplum/core"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "5.1.6"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-53728"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-345",
      "CWE-601"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-08-17T13:36:17Z",
    "nvd_published_at": null,
    "severity": "HIGH"
  },
  "details": "## Summary\n\nThe external identity provider callback at `GET /auth/external` accepts attacker-controlled redirect URIs that only need to start with a registered client redirect URI, rather than matching exactly. After a successful external IdP login, the server appends Medplum `login` and `code` values to that attacker-supplied URL and issues a redirect.\n\nBecause the external login request `state` is serialized as raw JSON and later trusted by the callback, an attacker who can tamper with `state.redirectUri` can cause Medplum to redirect authorization artifacts to an attacker-controlled endpoint. When the registered redirect URI is a bare origin or another prefix that can be extended into a different hostname, this becomes a cross-origin authorization code leak.\n\n## Technical Explanation\n\nThe vulnerable flow is exposed on the unauthenticated callback route `GET /auth/external`.\n\nIn `externalCallbackHandler()`, the server parses the external auth `state` and uses the decoded `clientId` and `redirectUri` after completing the IdP code exchange. If login succeeds and a client is found, the handler calls:\n\n- `getClientRedirectUri(client, body.redirectUri, true)`\n\nThe third argument explicitly enables partial matching. In `getClientRedirectUri()`, the function returns the attacker-supplied `requestedUri` whenever:\n\n- `requestedUri.startsWith(uri)`\n\nAs a result, any redirect URI beginning with a registered value is accepted. The returned URL is then passed into `new URL(redirectUri)`, and the server appends `login` and `code` query parameters before calling `res.redirect()`.\n\nAlthough `externalCallbackHandler()` later performs an exact-match lookup, that result is only used for logging and does not block the redirect. Therefore, the request is still redirected to the attacker-controlled URL even when it is not an exact registered redirect URI.\n\nA practical exploitation detail is that the registered redirect URI must be a prefix that can also prefix a different origin. For example:\n\n- Registered: `http://callback.audit.local`\n- Malicious: `http://callback.audit.local.oastify.com/cb`\n\nThe client-side external auth flow serializes the login request directly into the IdP `state` as JSON, which makes tampering straightforward in an intercepted or manually crafted authorization request.\n\n## Steps to Reproduce\n\n### Preconditions\n\n- The target `ClientApplication` has an `identityProvider` configured.\n- The target client has a registered redirect URI that is prefix-matchable into an attacker-controlled hostname, for example:\n  - Registered redirect URI: `http://callback.audit.local`\n- The attacker controls a collaborator endpoint such as:\n  - `https://\u003ccollaborator-host\u003e/cb`\n- The attacker uses a forged `state.redirectUri` that starts with the registered value, for example:\n  - `http://callback.audit.local.oastify.com/cb`\n  - or a collaborator domain that matches your local proof setup\n\n### Example forged state\n\n`{\"clientId\":\"\u003cmedplum-client-id\u003e\",\"redirectUri\":\"http://callback.audit.local.oastify.com/cb\",\"codeChallenge\":\"attack-verifier-123\",\"codeChallengeMethod\":\"plain\"}`\n\n**URL-encode the forged state**\n\n```\npython3 - \u003c\u003c\u0027PY\u0027\nimport json, urllib.parse\nstate = {\n  \"clientId\": \"\u003cmedplum-client-id\u003e\",\n  \"redirectUri\": \"http://callback.audit.local.oastify.com/cb\",\n  \"codeChallenge\": \"attack-verifier-123\",\n  \"codeChallengeMethod\": \"plain\",\n}\nprint(urllib.parse.quote(json.dumps(state, separators=(\u0027,\u0027, \u0027:\u0027))))\nPY\n```\n\n**Replay the external callback with cURL**\nUse a valid IdP authorization code obtained from a normal external login flow, then call the vulnerable callback directly:\n`curl -i \u0027http://api.audit.local:8103/auth/external?code=\u003cvalid-idp-code\u003e\u0026state=\u003cURLENCODED_FORGED_STATE\u003e`\n\nExpected result\nThe response is a 302 redirect to the attacker-controlled endpoint, including Medplum authorization artifacts in the query string:\n\n```\nHTTP/1.1 302 Found\nLocation: http://callback.audit.local.oastify.com/cb?login=\u003clogin-id\u003e\u0026code=\u003cmedplum-auth-code\u003e\n```\n\n**Collaborator proof**\nIf redirectUri points to a Burp Collaborator, Interactsh, or another attacker-controlled HTTP endpoint, that service receives the inbound request containing the leaked code in the query string. This demonstrates that Medplum is willing to forward authorization artifacts to an attacker-controlled destination when state.redirectUri only prefix-matches a registered client redirect URI.\n\n**Optional impact validation**\nIf the attacker supplied the PKCE verifier in the forged state, the leaked Medplum code can then be redeemed:\n\n```\ncurl -i -X POST \u0027http://api.audit.local:8103/oauth2/token\u0027 \\\n  -H \u0027Content-Type: application/x-www-form-urlencoded\u0027 \\\n  --data \u0027grant_type=authorization_code\u0026code=\u003cmedplum-auth-code\u003e\u0026code_verifier=attack-verifier-123\u0027\n```\n\n## Impact\n\nThe impact of this vulnerability is Critical, as it facilitates a full Account Takeover (ATO) of any user utilizing the external identity provider (IdP) flow. \n\n1. Full Account Takeover (ATO): \nAn attacker can successfully intercept the Medplum authorization \u0027code\u0027. Because the attacker controls the \u0027state\u0027 object, they can provide their own PKCE \u0027code_challenge\u0027. This allows the attacker to redeem the stolen code for a valid access token without knowing the victim\u0027s original secret, leading to total session hijacking.\n\n2. Bypassing Modern OAuth Protections: \nThis flaw explicitly bypasses the security benefits of PKCE (Proof Key for Code Exchange). By allowing an attacker to inject their own PKCE parameters into the tampered state, the server\u0027s verification mechanism is rendered useless against this specific redirection attack.\n\n3. Cross-Origin Data Leakage: \nThe \u0027startsWith\u0027 logic allows an attacker to break out of the intended origin. For example, a registered URI for \u0027https://app.medplum.com\u0027 could be extended to \u0027https://app.medplum.com.attacker.com\u0027, tricking the user and the browser\u0027s security model into sending sensitive credentials to an external host.\n\n4. Access to Sensitive Healthcare Data (PHI):\nGiven Medplum\u0027s role as a healthcare platform, a successful compromise grants the attacker the same permissions as the victim, potentially exposing Protected Health Information (PHI) and violating HIPAA or other regulatory compliance standards.\n\n5. Victim Trust Exploitation:\nThe attack occurs during a legitimate login flow. The victim interacts with the official Medplum server and their trusted IdP (e.g., Google or Microsoft), making the final redirection to the attacker-controlled URL nearly impossible for an average user to detect.\n\n## Mitigation\n- Require exact string equality for redirect URIs.\n- Bind external auth state to a server-side session or use a HMAC/Signature.\n- Reject prefixable or ambiguous redirect URI shapes during registration.",
  "id": "GHSA-m44r-7c5h-m6mj",
  "modified": "2026-08-17T13:36:17Z",
  "published": "2026-08-17T13:36:17Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/medplum/medplum/security/advisories/GHSA-m44r-7c5h-m6mj"
    },
    {
      "type": "WEB",
      "url": "https://github.com/medplum/medplum/pull/8749"
    },
    {
      "type": "WEB",
      "url": "https://github.com/medplum/medplum/commit/7ae10035ddadde4dba7b18d3156553940465b3a1"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/medplum/medplum"
    },
    {
      "type": "WEB",
      "url": "https://github.com/medplum/medplum/releases/tag/v5.1.6"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:L",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Medplum: Improper Validation of Redirect URI in External Auth Callback allows Authorization Code Leakage"
}

{
  "affected": [],
  "aliases": [
    "CVE-2015-8094"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-601"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2018-05-22T18:29:00Z",
    "severity": "MODERATE"
  },
  "details": "Open redirect vulnerability in Cloudera HUE before 3.10.0 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the next parameter.",
  "id": "GHSA-m47g-6x2g-p32r",
  "modified": "2022-05-14T03:15:07Z",
  "published": "2022-05-14T03:15:07Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2015-8094"
    },
    {
      "type": "WEB",
      "url": "https://github.com/cloudera/hue/pull/346"
    },
    {
      "type": "WEB",
      "url": "https://issues.cloudera.org/browse/HUE-3626"
    },
    {
      "type": "WEB",
      "url": "https://www.harmfultrust.com/p/advisories.html"
    },
    {
      "type": "WEB",
      "url": "http://cloudera.github.io/hue/latest/release-notes/release-notes-3.10.0.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2022-27547"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-601"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2022-08-29T16:15:00Z",
    "severity": "HIGH"
  },
  "details": "HCL iNotes is susceptible to a link to non-existent domain vulnerability. An attacker could use this vulnerability to trick a user into supplying sensitive information such as username, password, credit card number, etc.",
  "id": "GHSA-m4qq-492w-2qw2",
  "modified": "2022-09-02T00:01:02Z",
  "published": "2022-08-29T20:06:48Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-27547"
    },
    {
      "type": "WEB",
      "url": "https://support.hcltechsw.com/csm?id=kb_article\u0026sysparm_article=KB0100212"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "client-certificate-auth"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0.2.1"
            },
            {
              "fixed": "1.0.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-25651"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-601"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-02-06T18:54:33Z",
    "nvd_published_at": "2026-02-06T19:16:09Z",
    "severity": "MODERATE"
  },
  "details": "### Summary\n\nVersions 0.2.1 and 0.3.0 of `client-certificate-auth` contain an open redirect vulnerability. The middleware unconditionally redirects HTTP requests to HTTPS using the unvalidated `Host` header, allowing an attacker to redirect users to arbitrary domains.\n\n### Vulnerable Code\n\n```javascript\n// lib/clientCertificateAuth.js (versions 0.2.1, 0.3.0)\nif (!req.secure \u0026\u0026 req.header(\u0027x-forwarded-proto\u0027) != \u0027https\u0027) {\n  return res.redirect(\u0027https://\u0027 + req.header(\u0027host\u0027) + req.url);\n}\n```\n\n### Attack Scenario\n\n1. Attacker crafts a link: `http://vulnerable-app.example.com/login`\n2. When victim clicks, attacker intercepts and injects header: `Host: attacker.com`\n3. Server responds: `302 Found \u2192 https://attacker.com/login`\n4. Victim is redirected to attacker-controlled site\n\n### Impact\n\n- **Phishing**: Attackers can use trusted domain links to redirect victims to credential-harvesting pages\n- **OAuth/SSO Token Theft**: In authentication flows, authorization codes or tokens may leak via redirect\n- **Referer Leakage**: Sensitive URL parameters may be exposed to attacker domains via the Referer header\n- **Cache Poisoning**: In deployments with shared caches, malicious redirects may be cached and served to other users\n\n### Exploitability\n\nExploitation requires that HTTP traffic reaches the Node.js application without TLS termination setting `x-forwarded-proto: https`. This condition is uncommon in production deployments behind modern reverse proxies or load balancers, which limits real-world exploitability.\n\n### Fix\n\nThe vulnerable redirect behavior has been completely removed in version 1.0.0.\n\n```bash\nnpm install client-certificate-auth@^1.0.0\n```\n\n### Workarounds\n\nIf upgrading is not immediately possible:\n\n1. Block HTTP traffic at the network/load balancer level\n2. Ensure your reverse proxy always sets `x-forwarded-proto: https`\n3. Add middleware before `clientCertificateAuth` to validate the `Host` header against an allowlist\n\n### References\n\n- [CWE-601: URL Redirection to Untrusted Site](https://cwe.mitre.org/data/definitions/601.html)\n- [OWASP: Unvalidated Redirects and Forwards](https://cheatsheetseries.owasp.org/cheatsheets/Unvalidated_Redirects_and_Forwards_Cheat_Sheet.html)\n- [Fix Commit](https://github.com/tgies/client-certificate-auth/commit/8fc995e953db483495be46862965e50fe9e1cc52)",
  "id": "GHSA-m4w9-gch5-c2g4",
  "modified": "2026-02-06T21:43:18Z",
  "published": "2026-02-06T18:54:33Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/tgies/client-certificate-auth/security/advisories/GHSA-m4w9-gch5-c2g4"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-25651"
    },
    {
      "type": "WEB",
      "url": "https://github.com/tgies/client-certificate-auth/commit/8fc995e953db483495be46862965e50fe9e1cc52"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/tgies/client-certificate-auth"
    },
    {
      "type": "WEB",
      "url": "https://github.com/tgies/client-certificate-auth/releases/tag/v1.0.0"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "client-certificate-auth Vulnerable to Open Redirect via Host Header Injection in HTTP-to-HTTPS redirect"
}