CWE-601

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "sickchill"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "last_affected": "2024.3.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2024-53995"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-601"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2025-01-08T22:03:58Z",
    "nvd_published_at": "2025-01-08T21:15:12Z",
    "severity": "LOW"
  },
  "details": "SickChill is an automatic video library manager for TV shows. A user-controlled `login` endpoint\u0027s `next_` parameter takes arbitrary content. Prior to commit c7128a8946c3701df95c285810eb75b2de18bf82, an authenticated attacker may use this to redirect the user to arbitrary destinations, leading to open redirect. Commit c7128a8946c3701df95c285810eb75b2de18bf82 changes the login page to redirect to `settings.DEFAULT_PAGE` instead of to the `next` parameter.",
  "id": "GHSA-6gf2-ffq8-gcww",
  "modified": "2025-01-08T22:03:58Z",
  "published": "2025-01-08T22:03:58Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-53995"
    },
    {
      "type": "WEB",
      "url": "https://github.com/SickChill/sickchill/pull/8811"
    },
    {
      "type": "WEB",
      "url": "https://github.com/SickChill/sickchill/commit/c7128a8946c3701df95c285810eb75b2de18bf82"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/SickChill/sickchill"
    },
    {
      "type": "WEB",
      "url": "https://github.com/SickChill/sickchill/blob/846adafdfab579281353ea08a27bbb813f9a9872/sickchill/views/authentication.py#L33"
    },
    {
      "type": "ADVISORY",
      "url": "https://securitylab.github.com/advisories/GHSL-2024-283_GHSL-2024-291_sickchill_sickchill"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:L/VA:N/SC:L/SI:L/SA:L/E:P",
      "type": "CVSS_V4"
    }
  ],
  "summary": "GHSL-2024-288: SickChill open redirect in login"
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "drupal/core"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "7.0.0"
            },
            {
              "fixed": "7.70"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [],
  "database_specific": {
    "cwe_ids": [
      "CWE-601"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2024-05-15T20:48:59Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
  },
  "details": "Drupal 7 has an Open Redirect vulnerability. For example, a user could be tricked into visiting a specially crafted link which would redirect them to an arbitrary external URL.\n\nThe vulnerability is caused by insufficient validation of the destination query parameter in the drupal_goto() function.\n\nOther versions of Drupal core are not vulnerable.",
  "id": "GHSA-6gf6-24h2-66j4",
  "modified": "2024-05-15T20:48:59Z",
  "published": "2024-05-15T20:48:59Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/2020-05-20-1.yaml"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/drupal/core"
    },
    {
      "type": "WEB",
      "url": "https://www.drupal.org/sa-core-2020-003"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Drupal core Open Redirect vulnerability"
}

{
  "affected": [],
  "aliases": [
    "CVE-2025-42985"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-601"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-07-08T01:15:25Z",
    "severity": "MODERATE"
  },
  "details": "Due to insufficient sanitization in the SAP BusinessObjects Content Administrator Workbench, attackers could craft malicious URLs and execute scripts in a victim\ufffds browser. This could potentially lead to the exposure or modification of web client data, resulting in low impact on confidentiality and integrity, with no impact on application availability.",
  "id": "GHSA-6gv3-mm64-v4c8",
  "modified": "2025-07-08T03:31:01Z",
  "published": "2025-07-08T03:31:01Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-42985"
    },
    {
      "type": "WEB",
      "url": "https://me.sap.com/notes/3617380"
    },
    {
      "type": "WEB",
      "url": "https://url.sap/sapsecuritypatchday"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "Maven",
        "name": "org.xwiki.platform:xwiki-platform-oldcore"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "14.10.4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2023-32068"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-601"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2023-05-15T20:52:19Z",
    "nvd_published_at": "2023-05-15T21:15:09Z",
    "severity": "MODERATE"
  },
  "details": "### Impact\n\nIt\u0027s possible to exploit well known parameters in XWiki URLs to perform redirection to untrusted site. This vulnerability was partially fixed in the past for XWiki 12.10.7 and 13.3RC1 but there is still the possibility to force specific URLs to skip some checks, e.g. using URLs like `http:example.com` in the parameter would allow the redirect. \n\n### Patches\n\nThe issue has now been patched against all patterns that we know about for performing redirect. It also performs a real URI parsing that should protect in most cases. This has been patched in XWiki 14.10.4 and 15.0. \n\n### Workarounds\n\nThe only workaround is to upgrade XWiki.\n\n### References\n\n  * JIRA ticket: https://jira.xwiki.org/browse/XWIKI-20096\n  * JIRA ticket about the improvment actually fixing the vulnerability: https://jira.xwiki.org/browse/XWIKI-20549\n  * Previous advisory about open redirect: https://github.com/advisories/GHSA-jp55-vvmf-63mv\n\n### For more information\n\nIf you have any questions or comments about this advisory:\n* Open an issue in [Jira XWiki.org](https://jira.xwiki.org/)\n* Email us at [Security Mailing List](mailto:security@xwiki.org)\n\n## Attribution \n\nThanks to Paulos Mesfin who originally reported the vulnerability. ",
  "id": "GHSA-6gvj-8vc5-8v3j",
  "modified": "2023-05-15T20:52:19Z",
  "published": "2023-05-15T20:52:19Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-6gvj-8vc5-8v3j"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-32068"
    },
    {
      "type": "WEB",
      "url": "https://github.com/xwiki/xwiki-platform/commit/e4f7f68e93cb08c25632c126356d218abf192d1e"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/advisories/GHSA-jp55-vvmf-63mv"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/xwiki/xwiki-platform"
    },
    {
      "type": "WEB",
      "url": "https://jira.xwiki.org/browse/XWIKI-20096"
    },
    {
      "type": "WEB",
      "url": "https://jira.xwiki.org/browse/XWIKI-20549"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "org.xwiki.platform:xwiki-platform-oldcore Open Redirect vulnerability"
}

{
  "affected": [],
  "aliases": [
    "CVE-2020-25901"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-601"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2020-12-18T15:15:00Z",
    "severity": "MODERATE"
  },
  "details": "Host Header Injection in Spiceworks 7.5.7.0 allowing the attacker to render arbitrary links that point to a malicious website with poisoned Host header webpages.",
  "id": "GHSA-6gxp-j33j-9p33",
  "modified": "2024-04-04T03:03:53Z",
  "published": "2022-05-24T17:36:53Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-25901"
    },
    {
      "type": "WEB",
      "url": "https://frontend.spiceworks.com/topic/2309457-desktop-host-header-injection-vulnerability"
    },
    {
      "type": "WEB",
      "url": "https://github.com/Ramikan/Vulnerabilities/blob/master/Spiceworks%20version%207.5%20HTTP%20Header%20Injection"
    },
    {
      "type": "WEB",
      "url": "http://packetstormsecurity.com/files/160631/Spiceworks-7.5-HTTP-Header-Injection.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2026-17912"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-601"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-07-30T01:16:55Z",
    "severity": "MODERATE"
  },
  "details": "Inappropriate implementation in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page. (Chromium security severity: Low)",
  "id": "GHSA-6h54-mhpr-h92g",
  "modified": "2026-07-31T21:31:52Z",
  "published": "2026-07-30T03:31:16Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-17912"
    },
    {
      "type": "WEB",
      "url": "https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html"
    },
    {
      "type": "WEB",
      "url": "https://issues.chromium.org/issues/504202939"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2021-23888"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-601"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2021-03-26T10:15:00Z",
    "severity": "MODERATE"
  },
  "details": "Unvalidated client-side URL redirect vulnerability in McAfee ePolicy Orchestrator (ePO) prior to 5.10 Update 10 could cause an authenticated ePO user to load an untrusted site in an ePO iframe which could steal information from the authenticated user.",
  "id": "GHSA-6h63-w9wm-rccq",
  "modified": "2022-05-28T00:00:21Z",
  "published": "2022-05-24T17:45:33Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-23888"
    },
    {
      "type": "WEB",
      "url": "https://kc.mcafee.com/corporate/index?page=content\u0026id=SB10352"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "apache-airflow"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.2.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-40961"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-601"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-07-07T23:47:17Z",
    "nvd_published_at": "2026-06-01T09:16:18Z",
    "severity": "HIGH"
  },
  "details": "A bug in the login redirect route in Apache Airflow allowed authenticated users to craft URLs that bypassed the `is_safe_url` check, enabling redirection from a trusted Airflow domain to an attacker-controlled origin. Users are advised to upgrade to `apache-airflow` 3.2.2 or later. As a defense-in-depth mitigation, deployment operators can place Airflow behind a reverse proxy that strips off-domain `next=` query parameters before they reach the login endpoint.",
  "id": "GHSA-6hcw-qqr8-pjj8",
  "modified": "2026-07-07T23:47:17Z",
  "published": "2026-06-01T09:31:13Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-40961"
    },
    {
      "type": "WEB",
      "url": "https://github.com/apache/airflow/pull/65557"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/apache/airflow"
    },
    {
      "type": "WEB",
      "url": "https://lists.apache.org/thread/qmt8ksh7gty6b8hr9w294t94j36jdv1q"
    },
    {
      "type": "WEB",
      "url": "http://www.openwall.com/lists/oss-security/2026/05/31/2"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Apache Airflow: Authenticated users can bypass the `is_safe_url` check"
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "Maven",
        "name": "com.liferay:com.liferay.info.impl"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "5.0.69"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2025-43767"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-601"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2025-08-25T20:46:27Z",
    "nvd_published_at": "2025-08-23T04:15:45Z",
    "severity": "MODERATE"
  },
  "details": "Open Redirect vulnerability in /c/portal/edit_info_item parameter redirect in Liferay Portal 7.4.3.86 through 7.4.3.131, and Liferay DXP 2024.Q3.1 through 2024.Q3.9, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.12 and 7.4 update 86 through update 92 allows an attacker to exploit this security vulnerability to redirect users to a malicious site.",
  "id": "GHSA-6hj4-v2qp-cqr2",
  "modified": "2025-08-25T20:46:28Z",
  "published": "2025-08-23T06:30:19Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-43767"
    },
    {
      "type": "WEB",
      "url": "https://github.com/liferay/liferay-portal/commit/04d6892c12f8c3d12085124b6cb856dfacb9bb89"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/liferay/liferay-portal"
    },
    {
      "type": "WEB",
      "url": "https://liferay.atlassian.net/browse/LPE-18139"
    },
    {
      "type": "WEB",
      "url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43767"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Liferay Portal allows open redirect in /c/portal/edit_info_item parameter redirect"
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "webob"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.8.11"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-54770"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-601"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-08-27T22:10:07Z",
    "nvd_published_at": "2026-08-20T17:18:18Z",
    "severity": "MODERATE"
  },
  "details": "## Summary\n\nThis is a third follow-up to **CVE-2024-42353 / GHSA-mg3v-6m49-jhp3**\nand **CVE-2026-44889 / GHSA-fh3h-vg37-cc95**.\n\nWebOb makes the `Location` header absolute when it serves a redirect. To stop a\nrelative or protocol-relative target from redirecting users off-host, it checks\nthe value for a URI scheme and for a leading `//`, then joins it against the\nrequest URI with `urllib.parse.urljoin()`. The previous fix additionally stripped\nASCII tab/CR/LF from the value before those checks.\n\nHowever, on Python 3.10+ `urllib.parse.urljoin()` (via `urlsplit()`) does more\nthan remove tab/CR/LF: **it also strips leading and trailing C0 control\ncharacters (`U+0000`\u2013`U+001F`) and spaces from the URL before parsing it.**\nBecause WebOb\u0027s guard checks (`SCHEME_RE` and `startswith(\"//\")`) run against the\n*un-stripped* value, a single leading space or control byte slips past them, and\n`urljoin()` then silently removes that byte and parses what remains as a\nprotocol-relative \u2014 or even absolute \u2014 URL. The result is an open redirect to an\nattacker-controlled host.\n\n## Details\n\n`Response._make_location_absolute()` (in `src/webob/response.py`) performed,\nprior to the fix:\n\n```python\nvalue = value.replace(\"\\t\", \"\").replace(\"\\r\", \"\").replace(\"\\n\", \"\")\n\nif SCHEME_RE.search(value):          # ^[a-z]+:   -\u003e already absolute, return as-is\n    return value\n\nif value.startswith(\"//\"):           # neutralize protocol-relative URLs\n    value = f\"/%2f{value[2:]}\"\n\nnew_location = urlparse.urljoin(_request_uri(environ), value)\n```\n\nConsider the Location value `\" //www.example.com/test\"` (a single leading space):\n\n1. The explicit strip only removes `\\t`, `\\r`, `\\n` \u2014 the leading **space**\n   survives.\n2. `SCHEME_RE` (`^[a-z]+:`) does **not** match \u2014 the value starts with a space.\n3. `value.startswith(\"//\")` is **False** \u2014 the value starts with a space, not\n   `/`. The `//` \u2192 `/%2f` neutralization is skipped.\n4. `urllib.parse.urljoin(_request_uri(environ), \" //www.example.com/test\")` then\n   **strips the leading space** before parsing, sees `//www.example.com/test`,\n   treats it as protocol-relative, and returns\n   `http://www.example.com/test`.\n\nThe same bypass works with a value such as `\" https://www.example.com/test\"`\n(leading space + a full scheme): `SCHEME_RE` does not match the space-prefixed\nstring, but `urljoin()` strips the space and returns the fully absolute\nattacker URL `https://www.example.com/test`.\n\nAny C0 control character works equally well in place of the space, e.g.\n`\"\\x00//www.example.com/test\"` or `\"\\x1f//www.example.com/test\"`, because\n`urlsplit()` strips the whole leading C0-control-and-space run.\n\n### Affected entry points\n\n- **`Response.location`** \u2014 any application that sets a relative/attacker-influenced\n  `Location` and serves the response (the classic redirect path).\n- **`Request.relative_url()`** \u2014 used `urllib.parse.urljoin()` directly and was\n  subject to the same character stripping.\n- **`webob.exc._HTTPMove` subclasses** (`HTTPMovedPermanently`, `HTTPFound`,\n  `HTTPSeeOther`, `HTTPTemporaryRedirect`, `HTTPPermanentRedirect`, etc.) \u2014 these\n  built their absolute Location with `urlparse.urljoin(req.path_url, self.location)`\n  **without** going through `_make_location_absolute()` at all, so they bypassed\n  even the tab/CR/LF strip and the `//` \u2192 `/%2f` neutralization. A protocol-relative\n  location passed to e.g. `HTTPFound(location=\"//evil.example\")` redirected off-host.\n\n## Proof of Concept\n\n```python\nfrom webob import Response\nfrom webob.request import Request\n\nres = Response()\nres.status = \"301\"\nres.location = \" //www.example.com/test\"   # note the single leading space\n\nreq = Request.blank(\"/\")                    # request host is \"localhost\"\nprint(req.get_response(res).location)\n# Vulnerable (\u003c= 1.8.10):  http://www.example.com/test   \u003c-- open redirect\n# Fixed:                   http://localhost/ //www.example.com/test\n```\n\nAbsolute-URL variant:\n\n```python\nres.location = \" https://www.example.com/test\"\n# Vulnerable: https://www.example.com/test   \u003c-- off-host\n# Fixed:      http://localhost/ https://www.example.com/test\n```\n\nVia the HTTP exceptions:\n\n```python\nfrom webob import exc\n\nenviron = {\n    \"wsgi.url_scheme\": \"http\", \"SERVER_NAME\": \"localhost\",\n    \"SERVER_PORT\": \"80\", \"REQUEST_METHOD\": \"HEAD\", \"PATH_INFO\": \"/\",\n}\nm = exc.HTTPFound(location=\"//www.example.com/test\")\nm(environ, lambda *a, **k: None)\nprint(m.location)\n# Vulnerable: //www.example.com/test          \u003c-- open redirect\n# Fixed:      http://localhost/%2fwww.example.com/test\n```\n\n## Impact\n\nAn unauthenticated remote attacker who controls (in whole or part) the redirect\ntarget of an application built on WebOb can redirect a user from a trusted host to\nan attacker-controlled host. This enables phishing and credential-theft campaigns\nthat abuse the trusted origin, and can be chained with OAuth/SSO `redirect_uri`\nflows to leak tokens. Exploitation requires user interaction (following the\nredirect). Confidentiality and integrity impact are limited (`L`); the scope is\nchanged (`C`) because the trust boundary of the originating site is crossed.\n\n## Patches\n\nFixed by replacing the use of `urllib.parse.urljoin()` with WebOb\u0027s own\nRFC 3986 reference-resolution implementation, `webob.util.urljoin()`, which\nresolves the reference **exactly as given, character for character, with no\nwhitespace or control-character removal**.\n\n- `Response._make_location_absolute()` now uses `webob.util.urljoin()`.\n- `Request.relative_url()` now uses `webob.util.urljoin()`.\n- `webob.exc._HTTPMove` now normalizes its Location through the same\n  `_make_location_absolute()` code path as `Response`, so protocol-relative and\n  whitespace-smuggled locations are neutralized there too.\n\nUsers should upgrade to the patched release. There are no API changes.\n\n## Workarounds\n\n- Only ever set the `Location` header / redirect target to a fully-qualified URI\n  whose host you control, or strictly allowlist redirect destinations before\n  handing them to WebOb.\n- Reject any redirect target that does not begin with `https://yourhost/` (or a\n  validated relative path with no leading whitespace/control bytes).\n\n## References\n\n- This advisory: GHSA-6hx8-3wjj-gr8g\n- GHSA-fh3h-vg37-cc95 (CVE-2026-44889) \u2014 second incomplete fix (tab/CR/LF)\n- GHSA-mg3v-6m49-jhp3 (CVE-2024-42353) \u2014 original open redirect fix\n- RFC 3986, Section 5 \u2014 Reference Resolution: https://www.rfc-editor.org/rfc/rfc3986#section-5\n- Python `urllib.parse` URL stripping behavior (CPython 3.10+, removal of leading\n  and trailing C0 control and space characters): https://docs.python.org/3/library/urllib.parse.html\n  \nTo report a vulnerability to the Pylons Project please take a look at:\n\n - Pylons Project security policy and reporting process:\n  https://github.com/Pylons/.github/blob/main/SECURITY.md\n- Security contact (private, coordinated disclosure): `pylons-project-security@googlegroups.com`\n  (the Pylons Project requests a 90-day disclosure embargo)\n\n## Credit\n\nReported via the Pylons Project security mailing list by:\n\n- **tonghuaroot** \u2014 for the residual open redirect in\n  `Response._make_location_absolute()`: the 1.8.10 fix stripped only ASCII\n  tab/CR/LF, but `urllib.parse.urljoin()` also strips leading C0 control and\n  space characters, so values such as `\" //attacker.example/path\"` (and\n  `\" https://attacker.example/path\"`) still escaped off-host.\n- **Matheus Polkorny** \u2014 for identifying that the `webob.exc._HTTPMove`\n  redirect exceptions (`HTTPFound` and friends) performed their own\n  `urllib.parse.urljoin()` normalization and never went through\n  `_make_location_absolute()`, so a protocol-relative location such as\n  `//evil.example/path/` redirected off-host through that separate code path.",
  "id": "GHSA-6hx8-3wjj-gr8g",
  "modified": "2026-08-27T22:10:07Z",
  "published": "2026-08-27T22:10:07Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/Pylons/webob/security/advisories/GHSA-6hx8-3wjj-gr8g"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-54770"
    },
    {
      "type": "WEB",
      "url": "https://github.com/Pylons/webob/commit/ff89560643fb252751b4db8806a283b5377f1f07"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/Pylons/webob"
    },
    {
      "type": "WEB",
      "url": "https://github.com/Pylons/webob/tree/1.8.11"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "WebOb: Open redirect in Location header normalization via leading C0 control / space characters"
}