CVE-2026-107718: CWE-601: URL Redirection to Untrusted Site ('Open Redirect') in adonisjs http-server

AdonisJS HTTP Server improperly inserts route parameter values into URLs without applying encodeURIComponent in the createURL() helper used by Router.makeUrl() and Response.redirect().toRoute(). This affects dynamic first path segments and wildcard parameters, allowing an attacker to craft a value starting with a slash that results in a scheme-relative external URL. This open redirect vulnerability can be exploited to redirect users from trusted applications to attacker-controlled sites, impacting user trust and security. The flaw does not affect APIs that accept complete redirect URLs intentionally. Fixed in versions 8.2.3 and 9.3.0.

An attacker can exploit this vulnerability to redirect users to malicious external sites from a trusted AdonisJS application. This can facilitate phishing attacks or abuse of authentication and OAuth flows by misleading users into interacting with attacker-controlled domains. The vulnerability has a CVSS score of 6.1 (medium severity) with low complexity and requires user interaction.

Upgrade AdonisJS HTTP Server to version 8.2.3 or later, or 9.3.0 or later, where this vulnerability is fixed. No other mitigation is indicated by the vendor advisory.