CWE-601: Open Redirect vulnerabilities

Apache CXF contains an open redirect vulnerability in its OIDC relying-party component that allows redirection to attacker-controlled URLs after authentication. This occurs because state parameters controlled by an attacker are used as redirect targets without proper validation. Both directly and double-encoded URLs can exploit this issue. Fixed versions 4.2.4, 4.1.9, and 3.6.13 address this vulnerability.

A URL redirection vulnerability (CWE-601) exists in AdonisJS HTTP Server versions prior to 8.2.3 and between 9.0.0 and before 9.3.0. The issue arises because route parameter values are inserted into URLs without proper encoding, allowing attacker-controlled input to create scheme-relative external URLs. This can enable attackers to redirect users to malicious sites, potentially facilitating phishing or abuse of authentication flows. The vulnerability is fixed in versions 8.2.3 and 9.3.0.

CVE-2026-101152 is an open redirect vulnerability in Arista Networks CloudVision Portal's Single Sign-On (SSO) login flow. It allows a remote, unauthenticated attacker to craft a URL that causes the identity provider to send authentication material to an attacker-controlled URL instead of the legitimate CloudVision service. This vulnerability affects multiple versions of CloudVision Portal from 2021.1.0 through 2026.2.0. The CVSS score is 8.0, indicating high severity due to the potential for complete compromise of authentication credentials. No explicit patch information is provided, and no known exploits are reported in the wild.

CVE-2026-101151 is an open redirect vulnerability in Arista Networks CloudVision Portal. It occurs due to insufficient validation of URLs in the login flow, allowing unauthenticated attackers to redirect users to arbitrary external sites after authentication. This vulnerability has a medium severity with a CVSS score of 4.3 and could be leveraged in phishing or social engineering attacks.

### Impact Under certain conditions, an attacker can craft a redirect link that sends a guest user to an untrusted destination after authenticating. ### Patches Users should upgrade Payload packages to `>= 3.88.0` or `>= 4.0.0-canary.27`. ### Workarounds Upgrading is recommended. Until then, remove user-controlled redirect values from authentication flows or restrict them to known local paths.

An open redirect vulnerability exists in the PingGateway Fragment Filter feature. This issue affects PingGateway versions 7.1.0 and later, 2023.2.0 through 2024.11.1, and 2025.3.0 through 2025.11.1. It is fixed in versions 2024.11.2, 2025.11.2, and 2026.3.0 (and later).

Joomla Extension - svenbluege.de - Cross-site scripting and open redirect on the share mini page in Event Gallery extension < 6.6.0 - The page a shared image link opens (the share mini page of the front end) can link the article the image was shared from when the option "Share article links" is on. It took the address of the article from the shared link and printed it into the page without checking or escaping it; with the link type "Image Page with Redirect" it followed the address at once. A prepared link could therefore run a script in the page, in the session of the visitor who opened it, or send the visitor to another web site. Nothing on the server is changed or read by the server.

CVE-2026-39600 is an Open Redirect vulnerability in Mehul Gohil Aculect AI Companion versions before 0.8.2. This flaw allows attackers to redirect users to untrusted external sites, potentially facilitating phishing attacks. The vulnerability has a medium severity with a CVSS score of 4.7. No official patch or remediation guidance is currently available from the vendor.

The Giveaways and Contests by RafflePress WordPress plugin before 1.12.27 does not properly validate a giveaway's parent page URL before saving it and later redirecting visitors to it, allowing unauthenticated attackers to make the site's own giveaway confirmation and referral links redirect visitors to an arbitrary external site.

OpenRun versions prior to 0.17.7 contain an open redirect vulnerability (CWE-601) that allows attackers to bypass restrictions on redirect URLs. This flaw enables redirection to untrusted sites, potentially facilitating phishing or other malicious activities. The vulnerability has been patched in version 0.17.7.

Kiteworks Core before version 9.5.1 is vulnerable to Content Injection. A URL parameter in the PDF viewer was insufficiently validated, allowing an attacker-controlled document to be loaded and displayed under the trust of the legitimate application domain. This could increase the credibility of phishing attempts relying on malicious links embedded in the displayed content.

The Safe Redirect Manager WordPress plugin before 2.3.0 does not properly validate the redirect destination when a wildcard redirect rule to an absolute URL is configured, allowing unauthenticated attackers to redirect visitors to an arbitrary external website via a crafted request path.

An open redirect vulnerability (CWE-601) exists in The Wikimedia Foundation's Mediawiki Collection extension before version 1.46.1. This flaw allows attackers to craft URLs that redirect users to untrusted external sites, potentially enabling phishing or spoofing attacks by faking the source of data. The issue has been fixed in version 1.46.1.

Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an URL Redirection to Untrusted Site ('Open Redirect') vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Server-side request forgery.

A vulnerability in HPE OneView can be remotely exploited to cause a URL redirect.

A medium severity vulnerability (CVE-2026-97165) affects the Event Gallery extension for Joomla by svenbluege.de. Versions 1.0.0 through 6.0.0 are impacted by an open redirect issue where a base64-decoded 'return' parameter is used without validation, allowing redirection to untrusted sites. This vulnerability is categorized as CWE-601 (Open Redirect) and also involves reflected cross-site scripting (CWE-79).

IBM Financial Transaction Manager (FTM) for RedHat OpenShift is vulnerable to open redirect in the PMP `HostHeaderFilter` (`HostHeaderFilter.java:151`). An unauthenticated attacker can craft a request with a manipulated `Host` header to redirect authenticated operators to attacker-controlled sites, enabling credential phishing.

URL redirection to untrusted site ('open redirect') vulnerability in Abis Technology Ltd. Co. AVESİS allows Input Data Manipulation. This issue affects AVESİS: from 202608201331 before 202608240351.

The WP Ghost (Hide My WP Ghost) – Security & Firewall plugin for WordPress is vulnerable to Open Redirect in all versions up to, and including, 7.0.02. This is due to the plugin not properly validating user input. This makes it possible for unauthenticated attackers to redirect users to potentially malicious sites if they can successfully trick them into clicking on a specially crafted link. Exploitation requires tricking a logged-in user into clicking a crafted logout URL; the victim is fully logged out via wp_logout() before the malicious redirect is issued, making the logout irreversible as part of the attack chain.