CVE-2026-49820: CWE-601: URL Redirection to Untrusted Site ('Open Redirect') in getprobo probo
Probo is a self-hostable governance, risk, and compliance (GRC) platform built for engineering and security teams. Probo's `saferedirect` package validates redirect URLs used across authentication flows (OIDC, SAML, session transfer, OAuth connectors, and trust-center magic links). Prior to version 0.19.3.1, the validator only inspected the second character of relative paths, so a URL like `/../\evil.com` passed validation because the second character is `.`. Go's `http.Redirect` normalizes this path to `/\evil.com` before setting the `Location` header. Browsers can interpret the backslash as a host separator and redirect the user to an external domain (`https://evil.com`), bypassing the intended same-origin restriction. This enables open-redirect phishing: an attacker can craft a `continue` parameter (or embed a malicious URL in a session-transfer token) that appears to originate from a trusted Probo domain but redirects victims elsewhere. This is fixed in `go.probo.inc/probo` 0.193.1 by normalizing relative paths with `path.Clean` before validation, rejecting backslashes (including percent-encoded `%5c`) anywhere in the path, and re-checking the normalized result for protocol-relative and backslash prefixes. Self-hosted deployments should upgrade to probod v0.194.1 or later. SaaS deployments on getprobo.com are patched. No practical workaround is available for self-hosted installations.
AI Analysis
Technical Summary
Probo's saferedirect package validates redirect URLs used in authentication flows but prior to version 0.19.3.1, it only inspected the second character of relative paths, allowing URLs like '/../\evil.com' to pass validation. Go's http.Redirect normalizes such paths, causing browsers to interpret the backslash as a host separator and redirect users to an external domain, bypassing same-origin restrictions. This enables open-redirect phishing attacks where attackers craft malicious continue parameters or session-transfer tokens that appear to originate from trusted Probo domains. The vulnerability is fixed in version 0.19.3.1 by normalizing relative paths with path.Clean, rejecting backslashes (including percent-encoded %5c), and re-checking the normalized result for protocol-relative and backslash prefixes. Self-hosted deployments should upgrade to version 0.19.4.1 or later. SaaS deployments are already patched.
Potential Impact
This vulnerability allows attackers to perform open redirect phishing attacks by crafting URLs that appear to originate from trusted Probo domains but redirect victims to malicious external sites. This can lead to user deception and potential credential theft or other phishing impacts. There is no direct impact on confidentiality or availability, but it impacts integrity of user navigation and trust. The CVSS score is 4.7 (medium severity).
Mitigation Recommendations
A fix is available. Self-hosted Probo deployments must upgrade to version 0.19.4.1 or later to address this vulnerability. SaaS deployments on getprobo.com have already been patched by the vendor. No practical workaround exists for self-hosted installations, so upgrading is the recommended remediation.
CVE-2026-49820: CWE-601: URL Redirection to Untrusted Site ('Open Redirect') in getprobo probo
Description
Probo is a self-hostable governance, risk, and compliance (GRC) platform built for engineering and security teams. Probo's `saferedirect` package validates redirect URLs used across authentication flows (OIDC, SAML, session transfer, OAuth connectors, and trust-center magic links). Prior to version 0.19.3.1, the validator only inspected the second character of relative paths, so a URL like `/../\evil.com` passed validation because the second character is `.`. Go's `http.Redirect` normalizes this path to `/\evil.com` before setting the `Location` header. Browsers can interpret the backslash as a host separator and redirect the user to an external domain (`https://evil.com`), bypassing the intended same-origin restriction. This enables open-redirect phishing: an attacker can craft a `continue` parameter (or embed a malicious URL in a session-transfer token) that appears to originate from a trusted Probo domain but redirects victims elsewhere. This is fixed in `go.probo.inc/probo` 0.193.1 by normalizing relative paths with `path.Clean` before validation, rejecting backslashes (including percent-encoded `%5c`) anywhere in the path, and re-checking the normalized result for protocol-relative and backslash prefixes. Self-hosted deployments should upgrade to probod v0.194.1 or later. SaaS deployments on getprobo.com are patched. No practical workaround is available for self-hosted installations.
CVSS v3.1
Score 4.7medium
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
Probo's saferedirect package validates redirect URLs used in authentication flows but prior to version 0.19.3.1, it only inspected the second character of relative paths, allowing URLs like '/../\evil.com' to pass validation. Go's http.Redirect normalizes such paths, causing browsers to interpret the backslash as a host separator and redirect users to an external domain, bypassing same-origin restrictions. This enables open-redirect phishing attacks where attackers craft malicious continue parameters or session-transfer tokens that appear to originate from trusted Probo domains. The vulnerability is fixed in version 0.19.3.1 by normalizing relative paths with path.Clean, rejecting backslashes (including percent-encoded %5c), and re-checking the normalized result for protocol-relative and backslash prefixes. Self-hosted deployments should upgrade to version 0.19.4.1 or later. SaaS deployments are already patched.
Potential Impact
This vulnerability allows attackers to perform open redirect phishing attacks by crafting URLs that appear to originate from trusted Probo domains but redirect victims to malicious external sites. This can lead to user deception and potential credential theft or other phishing impacts. There is no direct impact on confidentiality or availability, but it impacts integrity of user navigation and trust. The CVSS score is 4.7 (medium severity).
Mitigation Recommendations
A fix is available. Self-hosted Probo deployments must upgrade to version 0.19.4.1 or later to address this vulnerability. SaaS deployments on getprobo.com have already been patched by the vendor. No practical workaround exists for self-hosted installations, so upgrading is the recommended remediation.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-x7qq-m748-8p2c
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-49820"]
- Ecosystems
- ["Go"]
- Database Specific Severity
- MODERATE
- Cvss Version
- 3.1
Threat ID: 6a4452e227e9c797198e11b3
Added to database: 06/30/2026, 23:36:02 UTC
Last enriched: 08/13/2026, 19:22:06 UTC
Last updated: 09/12/2026, 22:01:34 UTC
Views: 82
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.