CWE-601
CVEs classified under CWE-601, newest first.
309 CVEsRSS
CVE-2026-113384Medium· 4.3Optimal IdM OptimalCloud social redirect
A flaw has been found in Optimal IdM OptimalCloud 5.0. This vulnerability affects unknown code of the file /v5.0/social. Executing a manipulation of the argument state can lead to open redirect. The attack can be executed remotely. The v…
CVE-2026-112251Medium· 4.3PoCantoinersx clawhost Reverse Proxy reverseProxy.ts handleRequest redirect
A vulnerability was detected in antoinersx clawhost up to 0.0.45. This affects the function handleRequest of the file apps/clawhostgo/src/main/services/reverseProxy.ts of the component Reverse Proxy. Performing a manipulation of the argu…
CVE-2026-112040Medium· 4.3PoCdiem-project diem Sign-In BasedmUserActions.class.php redirect
A vulnerability was determined in diem-project diem up to 116974edfb9a5b8bd69cb13586dc62bcdbb485ad. This affects an unknown part of the file dmCorePlugin/plugins/dmUserPlugin/modules/dmUser/lib/BasedmUserActions.class.php of the componen…
CVE-2026-112034Medium· 4.3PoCaircheng-org iWebShop-5 Login Redirect _userInfo.php redirect
A weakness has been identified in aircheng-org iWebShop-5 up to 5.16. The impacted element is the function IController::redirect of the file plugins/_userInfo/_userInfo.php of the component Login Redirect. This manipulation of the argume…
CVE-2026-109937Medium· 5.4Otter Blocks < 3.2.3 - Unauthenticated Open Redirect via Stripe Checkout Block
The Otter Blocks WordPress plugin before 3.2.3 does not validate that a user-supplied return URL belongs to the site before using it to build the return destination of a Stripe Checkout session, allowing unauthenticated attackers to red…
CVE-2024-58398Medium· 4.3Coder 2.3.1 before 2.16.1 Open Redirect via Login Page redirect Parameter
Coder 2.3.1 before 2.14.4, 2.15.x before 2.15.3, and 2.16.0 before 2.16.1 contains an open redirect vulnerability in the login page because the redirect query parameter is improperly sanitized. Attackers can craft a Coder login URL that,…
CVE-2026-111931Medium· 4.3Coder 2.0.0 before 2.34.8 Open Redirect via Workspace App Proxy
Coder from 2.0.0 before 2.34.8 contains an open redirect vulnerability in handleAPIKeySmuggling that allows attackers to redirect users externally via unsanitized r.URL.Path values. Attackers can craft links on trusted workspace app subd…
CVE-2026-92432Medium· 4.3Patreon WordPress < 1.10.0 - Open Redirect via 'state' Parameter
The Patreon WordPress plugin before 1.10.0 does not validate a user-supplied redirect destination before redirecting, allowing unauthenticated attackers to redirect visitors to an arbitrary external URL through a crafted link, which is u…
CVE-2026-111622Medium· 6.8PoCsmart-sso through 2.1.1 contains an open redirect vulnerability in the /login handler that allows unauthenticated attackers to steal OAuth2 authorization codes by supplying an unvalidated redirectUri parameter
smart-sso through 2.1.1 contains an open redirect vulnerability in the /login handler that allows unauthenticated attackers to steal OAuth2 authorization codes by supplying an unvalidated redirectUri parameter. Attackers can send crafted…
CVE-2026-14452High· 8.6Improper validation of the reset_url parameter of the Setup in-page search in Checkmk <2.5.0p15, <2.4.0p38, <2.3.0p51 and 2.2.0 (EOL) allows an attacker to execute arbitrary script in the session of an authenticated user with Setup acces…
Improper validation of the reset_url parameter of the Setup in-page search in Checkmk <2.5.0p15, <2.4.0p38, <2.3.0p51 and 2.2.0 (EOL) allows an attacker to execute arbitrary script in the session of an authenticated user with Setup acces…
CVE-2026-111385Medium· 4.8PoCNezha 2.1.0 before 2.3.15 Host Header Injection via MCP Transfer Tools
Nezha from 2.1.0 before 2.3.15 contains a host header injection vulnerability in mintTransferTool that builds fs.download_url and fs.upload_url transfer URLs from the unvalidated Host header. Attackers who control the Host header seen on…
CVE-2026-55840Medium· 5.4PoCScoold is a Q&A and a knowledge sharing platform for teams
Scoold is a Q&A and a knowledge sharing platform for teams. Prior to 1.69.1, the getBackToUrl() method in src/main/java/com/erudika/scoold/utils/HttpUtils.java validates the backto and returnto parameters with Strings.CI.startsWith again…
CVE-2026-93649High· 7.5In the Eclipse Adoptium website (adoptium.net), in every deployment built from commit 0b24ea1 (2025-06-18) up to the fix in commit cbb53cf (2026-09-24), the post-download page /[locale]/download takes a download URL from the "link" query…
In the Eclipse Adoptium website (adoptium.net), in every deployment built from commit 0b24ea1 (2025-06-18) up to the fix in commit cbb53cf (2026-09-24), the post-download page /[locale]/download takes a download URL from the "link" query…
CVE-2026-72528Medium· 4.3"Handmade Marketplace App - Creema" provided by CREEMA LTD
"Handmade Marketplace App - Creema" provided by CREEMA LTD. contains an open redirect vulnerability. When accessing a specially crafted URL, a website set up by the attacker may be displayed within the app's screen of a user. As a result…
CVE-2026-82402Medium· 5.3PoCGogs is an open source self-hosted Git service
Gogs is an open source self-hosted Git service. Prior to 0.15.0+dev, an unauthenticated attacker can provide a backslash-containing target to the /redirect endpoint, and similar post-action redirect flows are also affected. internal/urlx…
CVE-2026-59180Low· 3.1Apprise forwards configured auth headers across cross-origin HTTP redirects
Apprise forwards configured auth headers across cross-origin HTTP redirects
CVE-2026-107369Medium· 6.1The auth0/nextjs-auth0 SDK validates that the returnTo parameter is a same-origin URL
The auth0/nextjs-auth0 SDK validates that the returnTo parameter is a same-origin URL. The SDK then stores this value and, in a later step, reconstructs it for the post-authentication redirect. The reconstruction logic can produce a URL …
CVE-2026-83646Medium· 4.8Url redirection to untrusted site ('open redirect') in Active Directory Federation Services (AD FS) allows an authorized attacker to perform spoofing over a network.
Url redirection to untrusted site ('open redirect') in Active Directory Federation Services (AD FS) allows an authorized attacker to perform spoofing over a network.
CVE-2026-83500Medium· 6.1Url redirection to untrusted site ('open redirect') in Windows BitLocker allows an unauthorized attacker to bypass a security feature with a physical attack.
Url redirection to untrusted site ('open redirect') in Windows BitLocker allows an unauthorized attacker to bypass a security feature with a physical attack.
CVE-2026-103576Medium· 6.5Url redirection to untrusted site ('open redirect') in Active Directory Federation Services (AD FS) allows an unauthorized attacker to perform spoofing over a network.
Url redirection to untrusted site ('open redirect') in Active Directory Federation Services (AD FS) allows an unauthorized attacker to perform spoofing over a network.
CVE-2026-66057Medium· 5.1Frappe is a full-stack web application framework
Frappe is a full-stack web application framework. Prior to 15.116.0 and 16.29.0, the OAuth login flow uses an unsanitized client-controlled state parameter to select post-authentication navigation, allowing a crafted state value to redir…
CVE-2026-109160Medium· 4.3A vulnerability was determined in PublicCMS up to 5.202608.a
A vulnerability was determined in PublicCMS up to 5.202608.a. Affected by this issue is the function SafeConfigComponent.getSafeUrl of the file publiccms-core/src/main/java/com/publiccms/logic/component/config/SafeConfigComponent.java of…
CVE-2026-7767Medium· 5.8GitLab has remediated an issue in GitLab CE/EE affecting all versions from 13.11 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an authenticated user controlling a Kubernetes …
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 13.11 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an authenticated user controlling a Kubernetes …
CVE-2026-89122Medium· 6.1SAP NetWeaver Enterprise Portal does not sufficiently validate input to a certain portal component
SAP NetWeaver Enterprise Portal does not sufficiently validate input to a certain portal component. An unauthenticated attacker could craft a malicious link that, when clicked by a victim, loads attacker-controlled content within the tru…
CVE-2026-92116Critical· 9.1OAuth1 callback validation vulnerability in Apache Allura. This issue affects Apache Allura: through 1.21.0. Users are recommended to upgrade to version 1.22.0, which fixes the issue.
OAuth1 callback validation vulnerability in Apache Allura. This issue affects Apache Allura: through 1.21.0. Users are recommended to upgrade to version 1.22.0, which fixes the issue.
CVE-2024-58389Medium· 6.1HoloViz Panel from 1.2.2 before 1.9.0 contains an open redirect vulnerability in panel/auth.py that allows remote attackers to redirect users by supplying an unvalidated next query parameter
HoloViz Panel from 1.2.2 before 1.9.0 contains an open redirect vulnerability in panel/auth.py that allows remote attackers to redirect users by supplying an unvalidated next query parameter. BasicLoginHandler and PasswordLoginHandler st…
CVE-2026-103523Medium· 6.1Thelia v2.6.0 contains an open redirect vulnerability in its address creation workflow
Thelia v2.6.0 contains an open redirect vulnerability in its address creation workflow. After a user accesses a crafted URL and successfully submits the “Add New Address” form, the application redirects them to the URL specified in the `…
CVE-2026-108261Critical· 9.3PoCTina is a headless content management system
Tina is a headless content management system. Prior to tinacms 3.14.0 and @tinacms/app 2.5.14, the /~/* admin preview route in packages/tinacms/src/admin/index.tsx can turn an attacker-controlled hash-router splat into an off-origin ifra…
CVE-2026-79650Medium· 6.1Apache CXF’s OIDC relying-party component could redirect users to an attacker-controlled URL after successful authentication. The issue occurs because attacker-controlled state parameters are preserved and later used as redirect targets …
Apache CXF’s OIDC relying-party component could redirect users to an attacker-controlled URL after successful authentication. The issue occurs because attacker-controlled state parameters are preserved and later used as redirect targets …
CVE-2026-107718Medium· 6.1AdonisJS HTTP Server is a package for handling HTTP requests in the AdonisJS framework
AdonisJS HTTP Server is a package for handling HTTP requests in the AdonisJS framework. Prior to 8.2.3 and 9.3.0, AdonisJS HTTP Server inserts route parameter values into URLs without encodeURIComponent in the shared createURL() helper u…