CVE-2026-54770: CWE-601: URL Redirection to Untrusted Site ('Open Redirect') in Pylons webob

WebOb's Response._make_location_absolute() method in versions before 1.8.11 fails to properly validate Location header values. It checks for URI schemes or leading double slashes before urllib.parse.urljoin() strips leading control characters and spaces, allowing an attacker to craft a Location value (e.g., a space followed by a protocol-relative or absolute URL) that bypasses these checks and results in an off-host redirect. Other affected components include Request.relative_url() and webob.exc._HTTPMove subclasses like HTTPFound, which use the same unsafe URL joining logic. This open redirect vulnerability can be exploited by unauthenticated attackers who can influence redirect targets to redirect users to attacker-controlled sites, potentially facilitating phishing or token theft. The issue is resolved in version 1.8.11.

An unauthenticated attacker who can control redirect targets can cause users to be redirected to malicious external sites. This can lead to phishing attacks or theft of OAuth and SSO tokens if users follow the redirect. The vulnerability requires user interaction and does not directly compromise confidentiality, integrity, or availability of the webob library itself.

Upgrade to webob version 1.8.11 or later, where the vulnerability is fixed. No other mitigation is required as the fix addresses the unsafe URL joining behavior.