Search
Find a vulnerability
Search criteria
ⓘ
Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.
2 vulnerabilities by dubinc
CVE-2026-85676 (GCVE-0-2026-85676)
Vulnerability from nvd – Published: 2026-09-04 14:32 – Updated: 2026-09-04 14:32
VLAI
EPSS
VEX
Title
Dub Open Redirect via Unrestricted redir_url Parameter
Summary
Dub contains an open redirect vulnerability in the redir_url query parameter that is accepted on every short link without validation or domain allowlist enforcement. Attackers can append the redir_url parameter to any short link to redirect visitors to arbitrary external URLs through the trusted Dub domain, bypassing destination blacklists and potentially enabling phishing attacks with link cloaking enabled.
Severity
4.3 (Medium)
CWE
- CWE-601 - URL Redirection to Untrusted Site ('Open Redirect')
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/dubinc/dub/issues/4337 | issue-tracking |
| https://github.com/dubinc/dub | product |
| https://github.com/dubinc/dub/blob/73415cf5e6be13… | technical-description |
| https://www.vulncheck.com/advisories/dub-open-red… | third-party-advisory |
Impacted products
Date Public
2026-08-16 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "dub",
"vendor": "dubinc",
"versions": [
{
"lessThanOrEqual": "73415cf5e6be13ce9adb7ba5e97474307db34a17",
"status": "affected",
"version": "0",
"versionType": "git"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "George Chen"
}
],
"datePublic": "2026-08-16T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Dub contains an open redirect vulnerability in the redir_url query parameter that is accepted on every short link without validation or domain allowlist enforcement. Attackers can append the redir_url parameter to any short link to redirect visitors to arbitrary external URLs through the trusted Dub domain, bypassing destination blacklists and potentially enabling phishing attacks with link cloaking enabled."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-601",
"description": "URL Redirection to Untrusted Site (\u0027Open Redirect\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-04T14:32:29.598Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Issue #4337",
"tags": [
"issue-tracking"
],
"url": "https://github.com/dubinc/dub/issues/4337"
},
{
"tags": [
"product"
],
"url": "https://github.com/dubinc/dub"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/dubinc/dub/blob/73415cf5e6be13ce9adb7ba5e97474307db34a17/apps/web/lib/middleware/utils/get-final-url.ts"
},
{
"name": "VulnCheck Advisory: Dub Open Redirect via Unrestricted redir_url Parameter",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/dub-open-redirect-via-unrestricted-redir-url-parameter"
}
],
"title": "Dub Open Redirect via Unrestricted redir_url Parameter",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-85676",
"datePublished": "2026-09-04T14:32:29.598Z",
"dateReserved": "2026-09-04T13:32:38.751Z",
"dateUpdated": "2026-09-04T14:32:29.598Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-85676 (GCVE-0-2026-85676)
Vulnerability from cvelistv5 – Published: 2026-09-04 14:32 – Updated: 2026-09-04 14:32
VLAI
EPSS
VEX
Title
Dub Open Redirect via Unrestricted redir_url Parameter
Summary
Dub contains an open redirect vulnerability in the redir_url query parameter that is accepted on every short link without validation or domain allowlist enforcement. Attackers can append the redir_url parameter to any short link to redirect visitors to arbitrary external URLs through the trusted Dub domain, bypassing destination blacklists and potentially enabling phishing attacks with link cloaking enabled.
Severity
4.3 (Medium)
CWE
- CWE-601 - URL Redirection to Untrusted Site ('Open Redirect')
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/dubinc/dub/issues/4337 | issue-tracking |
| https://github.com/dubinc/dub | product |
| https://github.com/dubinc/dub/blob/73415cf5e6be13… | technical-description |
| https://www.vulncheck.com/advisories/dub-open-red… | third-party-advisory |
Impacted products
Date Public
2026-08-16 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "dub",
"vendor": "dubinc",
"versions": [
{
"lessThanOrEqual": "73415cf5e6be13ce9adb7ba5e97474307db34a17",
"status": "affected",
"version": "0",
"versionType": "git"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "George Chen"
}
],
"datePublic": "2026-08-16T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Dub contains an open redirect vulnerability in the redir_url query parameter that is accepted on every short link without validation or domain allowlist enforcement. Attackers can append the redir_url parameter to any short link to redirect visitors to arbitrary external URLs through the trusted Dub domain, bypassing destination blacklists and potentially enabling phishing attacks with link cloaking enabled."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-601",
"description": "URL Redirection to Untrusted Site (\u0027Open Redirect\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-04T14:32:29.598Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Issue #4337",
"tags": [
"issue-tracking"
],
"url": "https://github.com/dubinc/dub/issues/4337"
},
{
"tags": [
"product"
],
"url": "https://github.com/dubinc/dub"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/dubinc/dub/blob/73415cf5e6be13ce9adb7ba5e97474307db34a17/apps/web/lib/middleware/utils/get-final-url.ts"
},
{
"name": "VulnCheck Advisory: Dub Open Redirect via Unrestricted redir_url Parameter",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/dub-open-redirect-via-unrestricted-redir-url-parameter"
}
],
"title": "Dub Open Redirect via Unrestricted redir_url Parameter",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-85676",
"datePublished": "2026-09-04T14:32:29.598Z",
"dateReserved": "2026-09-04T13:32:38.751Z",
"dateUpdated": "2026-09-04T14:32:29.598Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}