CVE-2026-118656 is an open redirect vulnerability in the labstack echo Go web framework. Versions prior to 4.16.0 and 5.4.0 improperly validate redirect targets, allowing specially crafted paths with a slash and TAB character to bypass checks. This can cause browsers to normalize the Location header to an attacker-controlled host. The issue is fixed in versions 4.16.0 and 5.4.0.
CVE-2026-111031 is an open redirect vulnerability in the Welcart e-Commerce WordPress plugin versions before 2.12.6. The plugin fails to validate user-supplied URLs before redirecting, allowing unauthenticated attackers to redirect users to arbitrary external sites. This vulnerability has a medium severity with a CVSS score of 4.7. It was fixed in version 2.12.6.
CVE-2026-116578 is an open redirect vulnerability in the Tornado Python web framework prior to version 6.6. The issue arises from tornado.web.RedirectHandler URL templates that allow regex-capture substitutions in certain positions, enabling crafted request paths to change the redirect scheme or network location. This can lead to attacker-controlled redirects on the application's domain, which can be exploited for phishing attacks. The vulnerability is fixed in Tornado version 6.6.
nforwardauth is a forward auth service that allows the use of a single authentication middleware for multiple sites. Versions prior to 1.5.1 accept an unvalidated `r` query parameter on the `/login` endpoint and use them as the post-authentication redirect destination. An unauthenticated attacker can create a legitimate `nforwardauth` login URL that redirects a victim to an attacker-controlled website after the victim successfully authenticates. This issue may facilitate phishing and other social-engineering attacks by abusing the trust associated with the legitimate authentication domain. This vulnerability does not provide an unauthenticated ForwardAuth bypass. Version 1.5.1 contains a patch.
CVE-2026-115196 is an Open Redirect vulnerability in Mautic's public form submission endpoint (/form/submit). After submitting a form, the application redirects users to a URL specified in the submission without verifying if it belongs to the Mautic instance or a trusted domain. This allows unauthenticated attackers to redirect visitors to arbitrary external sites, potentially phishing or malware sites. The vulnerability affects all Mautic instances with published forms prior to fixed versions.
Authlib versions prior to 1.8.0 contain an open redirect vulnerability due to improper handling of loopback HTTP exemptions in the is_secure_transport() function. This flaw allows an attacker to bypass TLS enforcement by supplying a URL with userinfo that begins with a loopback host, potentially causing cleartext redirection or acceptance of cleartext endpoints. The vulnerability does not bypass exact redirect URI matching and does not enable token forgery or user authentication bypass. The issue is fixed in version 1.8.0.
CVE-2026-87937 is an Open Redirect vulnerability in the Drupal Central Authentication System (CAS) Server. It affects versions from 0.0.0 up to but not including 2.0.4, and from 2.1.0 up to but not including 2.1.3. This flaw allows attackers to redirect users to untrusted sites, potentially enabling phishing or other malicious activities. The vulnerability has a medium severity with a CVSS score of 6.5. Fixed versions are 2.0.4 and 2.1.3.
CVE-2026-87945 is an Open Redirect vulnerability (CWE-601) in the Drupal SAML SSO - Service Provider module affecting versions from 0.0.0 up to but not including 3.2.0. This flaw allows attackers to redirect users to untrusted external sites by manipulating URLs. The vulnerability has a medium severity with a CVSS score of 5.4. A fix is available in version 3.2.0.
CVE-2024-4989 is an open redirect vulnerability in WSO2 API Manager affecting versions 4.1.0 up to but not including 4.1.0.153, 4.2.0 up to 4.2.0.105, and 4.3.0 up to 4.3.0.20. The vulnerability arises because the callback URL parameter does not properly validate user input, allowing attackers to redirect users to malicious websites. This can facilitate phishing attacks by tricking users into interacting with attacker-controlled links. The issue has a medium severity rating with a CVSS score of 5.4 and has been fixed in versions 4.1.0.153, 4.2.0.105, and 4.3.0.20.
CVE-2026-109937 is an open redirect vulnerability in the Otter Blocks WordPress plugin versions before 3.2.3. The plugin fails to validate that a user-supplied return URL belongs to the site when building the return destination of a Stripe Checkout session. This allows unauthenticated attackers to redirect users who complete or cancel checkout to arbitrary external URLs.
The Patreon WordPress plugin versions before 1.10.0 contain an open redirect vulnerability. This flaw allows unauthenticated attackers to craft URLs that redirect users to arbitrary external sites without validation. Such behavior can be exploited for phishing attacks by misleading users into visiting malicious websites.
Improper validation of the reset_url parameter of the Setup in-page search in Checkmk <2.5.0p15, <2.4.0p38, <2.3.0p51 and 2.2.0 (EOL) allows an attacker to execute arbitrary script in the session of an authenticated user with Setup access, or to redirect that user to an arbitrary external site, by tricking the user into opening a crafted URL and clicking the Reset button or submitting an empty search.
Scoold is a Q&A and a knowledge sharing platform for teams. Prior to 1.69.1, the getBackToUrl() method in src/main/java/com/erudika/scoold/utils/HttpUtils.java validates the backto and returnto parameters with Strings.CI.startsWith against the configured server URL. An attacker can supply an absolute URL whose hostname begins with the legitimate hostname, causing URI.resolve() to retain the attacker URL and the prefix check to accept it. A victim who follows the crafted sign-in link can be redirected to an attacker-controlled domain after authentication, enabling phishing and possible credential or token theft. This issue is fixed in version 1.69.1.
CVE-2026-93649 is a high-severity vulnerability in the Eclipse Foundation Adoptium Temurin website. The issue arises from improper validation of a redirect URL on the post-download page, which uses a naive string prefix check vulnerable to bypass via dot-segment normalization. This allows an attacker to craft a URL that appears to redirect to a trusted domain but actually leads to an attacker-controlled location, causing users to unknowingly download malicious binaries.
Gogs versions prior to 0.15.0+dev contain an open redirect vulnerability in the /redirect endpoint and similar post-action redirect flows. The issue arises from a mismatch in backslash normalization between URL validation and the Location header used in redirects, allowing attackers to craft URLs that redirect users to external attacker-controlled sites. This can be exploited for phishing attacks. The vulnerability is fixed in version 0.15.0+dev.
CVE-2026-103576 is an open redirect vulnerability in Active Directory Federation Services (AD FS) on Microsoft Windows 10 Version 1607. This flaw allows an unauthorized attacker to redirect users to untrusted sites, enabling spoofing attacks over a network. The vulnerability affects multiple builds of Windows 10 Version 1607 and has been assigned a medium severity rating with a CVSS score of 6.5. Official fixes have been released for all affected versions.
CVE-2026-83646 is an open redirect vulnerability (CWE-601) in Active Directory Federation Services (AD FS) on Microsoft Windows 10 Version 1607. This flaw allows an authorized attacker to redirect users to untrusted sites, enabling spoofing attacks over a network. The vulnerability affects multiple builds of Windows 10 Version 1607 prior to specific fixed versions. A patch is officially available to address this issue.
CVE-2026-83500 is an open redirect vulnerability (CWE-601) in Windows BitLocker on Windows 10 Version 1607 and related builds. This flaw allows an unauthorized attacker with physical access to bypass a security feature by redirecting URLs to untrusted sites. The vulnerability affects multiple Windows 10 builds prior to specific fixed versions. Microsoft has issued official fixes for all affected versions.
SAP NetWeaver Enterprise Portal does not sufficiently validate input to a certain portal component. An unauthenticated attacker could craft a malicious link that, when clicked by a victim, loads attacker-controlled content within the trusted application context. Successful exploitation could allow the attacker to track user information and deface parts of the rendered page, resulting in a low impact on confidentiality and integrity with no impact on availability.
CVE-2026-92116 is a critical OAuth1 callback validation vulnerability in Apache Allura up to version 1.21.0. It is an open redirect issue (CWE-601) that allows redirection to untrusted sites. The vulnerability is fixed in Apache Allura version 1.22.0.