CVE-2026-107718Medium· 6.1▾ SunlitAdonisJS HTTP Server is a package for handling HTTP requests in the AdonisJS framework. Prior to 8.2.3 and 9.3.0, AdonisJS HTTP Server inserts route parameter values into URLs without encodeURIComponent in the shared createURL() helper u…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 33.6 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Oct 9.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.3%
Last analysed / modified upstream
AdonisJS HTTP Server is a package for handling HTTP requests in the AdonisJS framework. Prior to 8.2.3 and 9.3.0, AdonisJS HTTP Server inserts route parameter values into URLs without encodeURIComponent in the shared createURL() helper used by Router.makeUrl() and Response.redirect().toRoute(). If an application places attacker-controlled data in a dynamic first path segment and uses the generated route URL as a redirect destination, a value beginning with a slash can produce a scheme-relative external URL. Wildcard parameters are affected by the same missing encoding, while APIs intentionally accepting complete redirect URLs are not affected. An attacker can redirect users from a trusted application to an attacker-controlled site, facilitating phishing or abuse of authentication and OAuth flows. This issue is fixed in versions 8.2.3 and 9.3.0.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Affected packages:
@adonisjs/http-server >= 9.0.0, <= 9.2.0@adonisjs/http-server <= 8.2.2Patched in:
@adonisjs/http-server 9.3.0@adonisjs/http-server 8.2.3Source: https://github.com/advisories/GHSA-2m6q-8v3h-jqww
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-101907High· 7.0Axios is a promise-based HTTP client for the browser and Node.js
CVE-2026-114614Low· 2.6Authlib: is_secure_transport() loopback exemption can be bypassed with a userinfo component, allowing cleartext-HTTP URLs to non-loopback…
CVE-2026-106322Medium· 6.1Open redirect in AppManifest in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to bypass web origin policy via a crafted HTML page
CVE-2023-6291High· 7.1A flaw was found in the redirect_uri validation logic in Keycloak
CVE-2023-6927Medium· 4.6A flaw was found in Keycloak
CVE-2026-47883Medium· 6.1UrlHandlerFilter can be vulnerable to an open redirect when configured with very broadly matching patterns