CWE-601
CVEs classified under CWE-601, newest first.
288 CVEsRSS
CVE-2026-117553High· 7.5Umbraco CMS before 17.7.2 and 18.2.2 Account Takeover via Host Header Poisoning
Umbraco CMS before 17.7.2 and 18.2.2 contains an authentication bypass vulnerability that allows unauthenticated attackers to register attacker-controlled OAuth redirect URIs by poisoning the Host header. Attackers send signed-in users a…
CVE-2026-114614Low· 2.6Authlib: is_secure_transport() loopback exemption can be bypassed with a userinfo component, allowing cleartext-HTTP URLs to non-loopback…
Authlib: is_secure_transport() loopback exemption can be bypassed with a userinfo component, allowing cleartext-HTTP URLs to non-loopback hosts
CVE-2026-116578Low· 2.1Tornado: Open redirect in RedirectHandler via protocol-relative URLs
Tornado is a Python web framework and asynchronous networking library. Prior to 6.6, tornado.web.RedirectHandler URL templates can place regex-capture substitutions where crafted request paths change the redirect scheme or network locati…
CVE-2026-81509Medium· 6.1nforwardauth: Unvalidated r parameter allows post-authentication open redirect
nforwardauth is a forward auth service that allows the use of a single authentication middleware for multiple sites. Versions prior to 1.5.1 accept an unvalidated `r` query parameter on the `/login` endpoint and use them as the post-auth…
CVE-2026-115196Medium· 5.4An Open Redirect vulnerability exists in the public form submission endpoint (/form/submit) of Mautic
An Open Redirect vulnerability exists in the public form submission endpoint (/form/submit) of Mautic. After a form is submitted, the application redirects the visitor to a return address supplied with the submission without verifying th…
CVE-2026-115537Medium· 4.3PoCgedelumbung HospitalManagement URL Validation routing_pages.php simpan redirect
A weakness has been identified in gedelumbung HospitalManagement up to c2d45543789a3887067d3915f69d44cfc2cf76a8. This affects the function simpan of the file application/modules/admin/controllers/routing_pages.php of the component URL Va…
CVE-2026-114060Low· 4.7SvelteKit: URL redirection to untrusted site via enhanced form submission
SvelteKit: URL redirection to untrusted site via enhanced form submission
CVE-2026-115360Medium· 4.7OpenBao before 2.6.3 Open Redirect via OIDC Identity Provider UI
OpenBao before 2.6.3 contains an open redirect vulnerability in the UI's OIDC identity provider that affects users not authenticated to OpenBao. Attackers can craft OIDC links that redirect unauthenticated users to attacker-controlled de…
CVE-2026-87945Medium· 5.4SAML SSO - Service Provider - Critical - Open redirect - SA-CONTRIB-2026-143
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Drupal SAML SSO - Service Provider allows Fake the Source of Data. This issue affects SAML SSO - Service Provider versions: from 0.0.0 to 3.2.0.
CVE-2026-87937Medium· 6.5Central Authentication System (CAS) Server - Moderately critical - Open redirect - SA-CONTRIB-2026-135
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Drupal Central Authentication System (CAS) Server allows Fake the Source of Data. This issue affects Central Authentication System (CAS) Server versions: from 0.0.0 to …
GHSA-pvhg-7v4p-f5q9Low· 4.7Duplicate Advisory: SvelteKit before 3.0.0 Open Redirect via Enhanced Form Actions
Duplicate Advisory: SvelteKit before 3.0.0 Open Redirect via Enhanced Form Actions
CVE-2024-4989Medium· 5.4Open Redirection via Callback URL in WSO2 API Manager Allows Phishing Attacks
The callback URL parameter in WSO2 API Manager fails to validate user-supplied input, allowing it to be controlled by malicious actors. Exploitation of this vulnerability could lead to users being redirected to attacker-controlled web p…
CVE-2026-111754Medium@angular/platform-server: Open Redirect via Protocol-Relative URLs in Server-Side Rendering (SSR)
@angular/platform-server: Open Redirect via Protocol-Relative URLs in Server-Side Rendering (SSR)
CVE-2026-113384Medium· 4.3Optimal IdM OptimalCloud social redirect
A flaw has been found in Optimal IdM OptimalCloud 5.0. This vulnerability affects unknown code of the file /v5.0/social. Executing a manipulation of the argument state can lead to open redirect. The attack can be executed remotely. The v…
CVE-2026-112251Medium· 4.3PoCantoinersx clawhost Reverse Proxy reverseProxy.ts handleRequest redirect
A vulnerability was detected in antoinersx clawhost up to 0.0.45. This affects the function handleRequest of the file apps/clawhostgo/src/main/services/reverseProxy.ts of the component Reverse Proxy. Performing a manipulation of the argu…
CVE-2026-112040Medium· 4.3PoCdiem-project diem Sign-In BasedmUserActions.class.php redirect
A vulnerability was determined in diem-project diem up to 116974edfb9a5b8bd69cb13586dc62bcdbb485ad. This affects an unknown part of the file dmCorePlugin/plugins/dmUserPlugin/modules/dmUser/lib/BasedmUserActions.class.php of the componen…
CVE-2026-112034Medium· 4.3PoCaircheng-org iWebShop-5 Login Redirect _userInfo.php redirect
A weakness has been identified in aircheng-org iWebShop-5 up to 5.16. The impacted element is the function IController::redirect of the file plugins/_userInfo/_userInfo.php of the component Login Redirect. This manipulation of the argume…
CVE-2026-109937Medium· 5.4Otter Blocks < 3.2.3 - Unauthenticated Open Redirect via Stripe Checkout Block
The Otter Blocks WordPress plugin before 3.2.3 does not validate that a user-supplied return URL belongs to the site before using it to build the return destination of a Stripe Checkout session, allowing unauthenticated attackers to red…
CVE-2024-58398Medium· 4.3Coder 2.3.1 before 2.16.1 Open Redirect via Login Page redirect Parameter
Coder 2.3.1 before 2.14.4, 2.15.x before 2.15.3, and 2.16.0 before 2.16.1 contains an open redirect vulnerability in the login page because the redirect query parameter is improperly sanitized. Attackers can craft a Coder login URL that,…
CVE-2026-111931Medium· 4.3Coder 2.0.0 before 2.34.8 Open Redirect via Workspace App Proxy
Coder from 2.0.0 before 2.34.8 contains an open redirect vulnerability in handleAPIKeySmuggling that allows attackers to redirect users externally via unsanitized r.URL.Path values. Attackers can craft links on trusted workspace app subd…
CVE-2026-92432Medium· 4.3Patreon WordPress < 1.10.0 - Open Redirect via 'state' Parameter
The Patreon WordPress plugin before 1.10.0 does not validate a user-supplied redirect destination before redirecting, allowing unauthenticated attackers to redirect visitors to an arbitrary external URL through a crafted link, which is u…
CVE-2026-111622Medium· 6.8PoCsmart-sso through 2.1.1 OAuth2 Authorization Code Theft via Unvalidated redirectUri
smart-sso through 2.1.1 contains an open redirect vulnerability in the /login handler that allows unauthenticated attackers to steal OAuth2 authorization codes by supplying an unvalidated redirectUri parameter. Attackers can send crafted…
CVE-2026-14452High· 8.6Improper validation of the reset_url parameter of the Setup in-page search in Checkmk <2.5.0p15, <2.4.0p38, <2.3.0p51 and 2.2.0 (EOL) allows an attacker to execute arbitrary script in the session of an authenticated user with Setup acces…
Improper validation of the reset_url parameter of the Setup in-page search in Checkmk <2.5.0p15, <2.4.0p38, <2.3.0p51 and 2.2.0 (EOL) allows an attacker to execute arbitrary script in the session of an authenticated user with Setup acces…
CVE-2026-111385Medium· 4.8PoCNezha 2.1.0 before 2.3.15 Host Header Injection via MCP Transfer Tools
Nezha from 2.1.0 before 2.3.15 contains a host header injection vulnerability in mintTransferTool that builds fs.download_url and fs.upload_url transfer URLs from the unvalidated Host header. Attackers who control the Host header seen on…
CVE-2026-55840Medium· 5.4PoCScoold is a Q&A and a knowledge sharing platform for teams
Scoold is a Q&A and a knowledge sharing platform for teams. Prior to 1.69.1, the getBackToUrl() method in src/main/java/com/erudika/scoold/utils/HttpUtils.java validates the backto and returnto parameters with Strings.CI.startsWith again…
CVE-2026-93649High· 7.5In the Eclipse Adoptium website (adoptium.net), in every deployment built from commit 0b24ea1 (2025-06-18) up to the fix in commit cbb53cf (2026-09-24), the post-download page /[locale]/download takes a download URL from the "link" query…
In the Eclipse Adoptium website (adoptium.net), in every deployment built from commit 0b24ea1 (2025-06-18) up to the fix in commit cbb53cf (2026-09-24), the post-download page /[locale]/download takes a download URL from the "link" query…
CVE-2026-72528Medium· 4.3"Handmade Marketplace App - Creema" provided by CREEMA LTD
"Handmade Marketplace App - Creema" provided by CREEMA LTD. contains an open redirect vulnerability. When accessing a specially crafted URL, a website set up by the attacker may be displayed within the app's screen of a user. As a result…
CVE-2026-82402Medium· 5.3PoCGogs is an open source self-hosted Git service
Gogs is an open source self-hosted Git service. Prior to 0.15.0+dev, an unauthenticated attacker can provide a backslash-containing target to the /redirect endpoint, and similar post-action redirect flows are also affected. internal/urlx…
CVE-2026-59180Low· 3.1Apprise forwards configured auth headers across cross-origin HTTP redirects
Apprise forwards configured auth headers across cross-origin HTTP redirects
CVE-2026-107369Medium· 6.1The auth0/nextjs-auth0 SDK validates that the returnTo parameter is a same-origin URL
The auth0/nextjs-auth0 SDK validates that the returnTo parameter is a same-origin URL. The SDK then stores this value and, in a later step, reconstructs it for the post-authentication redirect. The reconstruction logic can produce a URL …