CVE-2026-44889 is an open redirect vulnerability in the Pylons webob library affecting versions before 1.8.10. The vulnerability arises from how webob normalizes the HTTP Location header during redirects by joining the redirect target to the request URI using Python's urljoin function. Since Python 3.10, urlsplit strips ASCII tab, carriage return, and newline characters before parsing, which can cause a redirect target containing such characters to be interpreted as a protocol-relative URL with an attacker-controlled host. This behavior bypasses the prior fix (CVE-2024-42353) that escaped leading double slashes, allowing attackers who control the redirect location to redirect users to arbitrary external sites. The vulnerability has a CVSS 3.1 score of 6.1 (medium severity) and is fixed in webob version 1.8.10.

An attacker who can influence the redirect location in webob versions prior to 1.8.10 can redirect users to arbitrary external websites, potentially facilitating phishing or other social engineering attacks. The vulnerability impacts confidentiality and integrity by misleading users about the destination of redirects. There is no direct impact on availability. No known exploits in the wild have been reported.

Upgrade webob to version 1.8.10 or later, where this open redirect vulnerability is fixed. Since no official patch or temporary fix is detailed beyond this version update, applying the upgrade is the recommended remediation. No other mitigation or workaround is indicated.