CVE-2026-33397 is a security vulnerability classified as an Open Redirect (CWE-601) in Angular's server-side rendering package (@angular/ssr), specifically affecting versions 22.x prior to 22.0.0-next.2, 21.x prior to 21.2.3, and 20.x prior to 20.3.21. This vulnerability stems from an incomplete fix for a previous similar issue (CVE-2026-27738). The core problem lies in the validation logic of the X-Forwarded-Prefix HTTP header, which is commonly used when Angular SSR applications are deployed behind proxies. While the prior fix blocked multiple leading forward slashes (///), it failed to consider a single backslash (\) as a bypass vector. When an attacker supplies an X-Forwarded-Prefix header starting with a backslash, the Angular SSR engine prepends a forward slash, resulting in a Location header containing a URL with a /\ sequence. Modern browsers interpret this sequence as //, which is a protocol-relative URL, causing the browser to redirect users to a domain controlled by the attacker. This redirection occurs without requiring any user interaction or authentication, making it a straightforward attack vector. Moreover, the HTTP response does not include a Vary: X-Forwarded-Prefix header, which means that malicious redirect responses can be cached by intermediate proxies or CDNs, enabling web cache poisoning attacks that affect multiple users. The vulnerability has a CVSS 4.0 base score of 6.9, indicating medium severity, with network attack vector, low complexity, no privileges or user interaction needed, and limited scope. The issue has been patched in versions 22.0.0-next.2, 21.2.3, and 20.3.21. Until patches are applied, developers are advised to sanitize the X-Forwarded-Prefix header in their server.ts files before the Angular SSR engine processes the request, effectively blocking malicious input and preventing the redirect flaw.

This vulnerability allows attackers to redirect users of Angular SSR applications to arbitrary, attacker-controlled websites without any user interaction or authentication. Such open redirects can be exploited in phishing campaigns, enabling attackers to craft URLs that appear legitimate but redirect victims to malicious sites for credential theft, malware distribution, or other social engineering attacks. The lack of the Vary: X-Forwarded-Prefix header exacerbates the risk by allowing malicious redirect responses to be cached by intermediate proxies or CDNs, potentially affecting a large number of users through web cache poisoning. This can lead to widespread exposure to malicious redirects even for users who do not directly interact with the attacker. Organizations running Angular SSR applications behind proxies that use the X-Forwarded-Prefix header are particularly at risk. The vulnerability impacts confidentiality by facilitating phishing and credential theft, and availability could be indirectly affected if users lose trust or are blocked due to malicious redirects. Given the ease of exploitation over the network without privileges or user interaction, the threat is significant for web applications relying on vulnerable Angular SSR versions.

1. Upgrade Angular SSR to the patched versions: 22.0.0-next.2 or later, 21.2.3 or later, and 20.3.21 or later as soon as possible. 2. Until upgrades are feasible, implement strict sanitization of the X-Forwarded-Prefix header in the server.ts file or equivalent server-side entry point. This includes rejecting or normalizing any header values starting with backslashes or other suspicious characters that could bypass validation. 3. Add the HTTP response header 'Vary: X-Forwarded-Prefix' to ensure that caches differentiate responses based on this header, preventing cache poisoning. 4. Employ web application firewalls (WAFs) or reverse proxies with rules to detect and block suspicious X-Forwarded-Prefix header values containing backslashes or malformed inputs. 5. Conduct thorough testing of SSR applications behind proxies to verify that redirects are properly validated and do not allow protocol-relative URLs. 6. Educate developers and DevOps teams about the risks of trusting proxy headers without validation, especially in SSR contexts. 7. Monitor logs for unusual redirect patterns or requests with suspicious X-Forwarded-Prefix headers to detect exploitation attempts early.