{"uuid": "1d8da793-c9a6-46ae-97b7-bfb9ca259899", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "GHSA-6hx8-3wjj-gr8g", "type": "seen", "source": "https://gist.github.com/alon710/3f2dc90a23f10e17e098821e66e18187", "content": "# CVE-2026-54770: CVE-2026-54770: Open Redirect via Parser Differential in WebOb\n\n> **CVSS Score:** 6.1\n> **Published:** 2026-08-27\n> **Full Report:** https://cvereports.com/reports/CVE-2026-54770\n\n## Summary\nAn open redirect vulnerability exists in WebOb before version 1.8.11 due to a parser differential between WebOb's validation logic and Python's standard urllib.parse.urljoin() function. Under Python 3.10+, the urljoin function strips leading and trailing space characters and C0 control characters, which allowed specially crafted inputs to bypass WebOb's prefix checks while still resolving as off-host redirects.\n\n## TL;DR\nA parser differential between WebOb and Python's urljoin on modern runtimes allows unauthenticated attackers to bypass open redirect protections using leading spaces or control characters.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-601\n- **Attack Vector**: Network\n- **CVSS v3.1**: 6.1 (Medium)\n- **EPSS Score**: 0.00339 (0.34%)\n- **Exploit Status**: Proof-of-Concept\n- **KEV Status**: Not Listed\n- **Impact**: Open Redirect / Phishing\n\n## Affected Systems\n\n- WebOb on Python 3.10+\n- **WebOb**: < 1.8.11 (Fixed in: `1.8.11`)\n\n## Mitigation\n\n- Upgrade the WebOb library to version 1.8.11 or later.\n- Implement application-layer validation to reject redirection inputs containing leading whitespace or control characters.\n- Deploy Web Application Firewall (WAF) filters to intercept and block anomalous redirection headers.\n\n**Remediation Steps:**\n1. Execute `pip install --upgrade webob` to pull the latest security release.\n2. Confirm requirements.txt or pipfile contains strict pinning of `webob>=1.8.11`.\n3. Verify redirection flows within legacy application code to ensure all redirect functions utilize the standardized validation paths.\n\n## References\n\n- [https://github.com/Pylons/webob/security/advisories/GHSA-6hx8-3wjj-gr8g](https://github.com/Pylons/webob/security/advisories/GHSA-6hx8-3wjj-gr8g)\n- [https://github.com/Pylons/webob/commit/ff89560643fb252751b4db8806a283b5377f1f07](https://github.com/Pylons/webob/commit/ff89560643fb252751b4db8806a283b5377f1f07)\n- [https://github.com/Pylons/webob/tree/1.8.11](https://github.com/Pylons/webob/tree/1.8.11)\n- [https://nvd.nist.gov/vuln/detail/CVE-2026-54770](https://nvd.nist.gov/vuln/detail/CVE-2026-54770)\n- [https://www.cve.org/CVERecord?id=CVE-2026-54770](https://www.cve.org/CVERecord?id=CVE-2026-54770)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-54770) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-27T23:33:29.014133Z"}