URL Redirection to Untrusted Site ('Open Redirect') vulnerability in ash-project ash_typescript allows an attacker who controls a path-parameter value to redirect a generated client's request, and the credentials attached to it, to an unintended route or an external origin.
The URL builders in lib/ash_typescript/typed_controller/codegen/route_renderer.ex replace each :param placeholder with a bare template interpolation and never call encodeURIComponent, so the value reaches executeTypedControllerRequest raw. A value containing ../ is normalised away by the fetch URL resolver and reaches a different route, while ? or # truncates the path and can smuggle or override query parameters. For a route whose path begins with a parameter, a value such as /evil.example.com/x yields the protocol-relative URL //evil.example.com/x, sending the request and the credentials from TypedControllerConfig to an attacker-controlled host. Nothing constrains the value at runtime: get_path_param_type/2 emits only a TypeScript type, which is erased.
The query-string path is unaffected, since URLSearchParams.set encodes its own values.
This issue affects ash_typescript: from 0.15.0 before 0.18.0.
Joomla Extension - joomshaper.com - Open Redirect via Base64 Return Parameter in Helix Ultimate < 2.2.10 - Return redirect parameters accepted arbitrary Base64 strings without verifying whether the resolved target was an internal site URL via Uri::isInternal.
CVE-2026-81342 is an open redirect vulnerability in the MasterStudy LMS WordPress Plugin before version 3.7.43. It occurs because the plugin does not validate a redirect parameter supplied during user registration, allowing unauthenticated attackers to redirect users to arbitrary external URLs. This vulnerability has a medium severity score of 4.7 and requires user interaction to exploit.
CVE-2026-59355 is an open redirect vulnerability in VMware Spring Authorization Server versions 1.5.0 through 1.5.7. The authorization endpoint does not sufficiently validate the request_uri parameter, allowing an attacker to craft a request with an invalid request_uri and an unvalidated redirect_uri. This can lead to redirection to attacker-controlled sites, potentially facilitating phishing or other malicious activities. The vulnerability has a CVSS score of 6.1, indicating medium severity.
CVE-2026-47887 is an open redirect vulnerability in the Spring Framework affecting multiple versions from 5.2.25.RELEASE and earlier through 7.0.8. It arises when a Spring MVC application uses UrlFileNameViewController mapped with an end-of-path and lacks a configured prefix, allowing redirection to untrusted sites. The vulnerability has a medium severity with a CVSS score of 6.1.
CVE-2026-47883 is an open redirect vulnerability in the UrlHandlerFilter component of the Spring Framework, affecting Spring MVC and Spring WebFlux. It arises when the filter is configured with broadly matching patterns, enabling redirection to untrusted sites. This vulnerability affects Spring Framework versions 6.2.0 through 6.2.19 and 7.0.0 through 7.0.8. The CVSS score of 6.1 indicates medium severity.
Miniflux v2 before version 2.3.1 contains an open redirect vulnerability due to improper handling of redirect URLs with backslashes. This allows an unauthenticated attacker to bypass relative-path and host checks in the login flow and redirect users to attacker-controlled external sites. The issue is fixed in version 2.3.1.
Joomla Extension - j2commerce.com - Open redirect in cart controller in J2Store 1.0.0-3.3.20, 4.0.0-4.0.20, 4.1.0-4.1.5 - Four task handlers accepted a base64-encoded URL from user input and redirected to it without validating the destination host, enabling phishing using the shop's trusted domain. No authentication required.
A reflected cross-site scripting (XSS) and open redirect vulnerability exists in the Zoo extension for Joomla versions 1.0.0 through 4.1.65. The issue arises from improper neutralization of input in the submission redirect parameter. This vulnerability could allow an attacker to execute arbitrary scripts in the context of the affected web application.
SecureDrop Client is a desktop app for journalists to securely communicate with sources and handle submissions on the SecureDrop Workstation. Prior to version 1.3.1, a malicious SecureDrop Server could bypass securedrop-proxy's origin limitation by responding with cross-origin redirects. SecureDrop Server itself has multiple layers of built-in hardening, and is a dedicated physical machine exposed on the internet only via Tor hidden services for the Source and Journalist interfaces, and optionally via remote SSH access over another Tor hidden service. A newsroom's SecureDrop Workstation communicates only with its own dedicated SecureDrop Server. Version 1.3.1 fixes the issue.
CVE-2026-53586 is a vulnerability in libgit2's built-in HTTP transport prior to versions 1.8.6 and 1.9.5. The issue involves improper handling of HTTP redirects and credential callbacks, causing sensitive HTTP Basic credentials or personal access tokens to be exposed to unauthorized actors if an attacker controls a trusted Git host or an open redirect. This vulnerability is fixed in libgit2 versions 1.8.6 and 1.9.5.
CVE-2026-54770 is an open redirect vulnerability in the Pylons webob library prior to version 1.8.11. The issue arises from improper handling of Location header values in HTTP responses, allowing attacker-controlled input to bypass URL scheme checks and cause redirects to untrusted external sites. Exploitation requires user interaction by following the malicious redirect. The vulnerability is fixed in webob version 1.8.11.
CVE-2026-71428 is an open redirect vulnerability in the unstructured library versions from 0.4.7 up to but not including 0.24.0. The library's functions partition, partition_html, and partition_md fetch URLs without validating the host, allowing attackers controlling the URL to induce server-side requests to internal or cloud metadata endpoints. This can lead to disclosure of internal responses and potentially trigger side-effecting GET endpoints. The vulnerability is fixed in version 0.24.0.
Punk::OAuth2 versions before 0.03 for Perl contain an open redirect vulnerability due to improper validation of the return parameter after login. The same_origin_path function incorrectly allows backslash and tab characters, which can be interpreted as slashes in URLs, enabling attackers to redirect users to malicious sites after authentication. This redirect occurs without exposing authorization codes or access tokens.
Etherpad versions from 2.1.0 up to but not including 3.1.0 are vulnerable to a cross-site scripting (XSS) issue via the x-proxy-path HTTP header. This header is used without proper sanitization in the admin interface, allowing an attacker to inject scripts that may be cached and served to administrators. Additionally, version 3.0.0 allows an open redirect via the same header in the timeslider feature. These vulnerabilities require that client-supplied x-proxy-path headers reach the Etherpad server. The issues are fixed in version 3.1.0.
Grav is a file-based Web platform. Prior to 3.8.5, the Login plugin twofa_cancel task accepts a client-controlled _redirect field without a nonce and allows an unauthenticated request to set an external http, https, or protocol-relative Location target. Controller::execute() applies the field when taskTwofa_cancel() sets no redirect, and Grav::getRedirectResponse() accepts the target through Uri::isExternal(), enabling phishing redirects from a trusted Grav host. This issue is fixed in version 3.8.5.
An open redirect vulnerability (CWE-601) exists in the yootheme.com Zoo extension for Joomla versions 1.0.0 through 4.1.63. The vulnerability occurs in the CommentController::twitterAuthenticate() function where the referer request parameter is passed directly to setRedirect() without validation, allowing redirection to untrusted sites. This issue has a medium severity with a CVSS score of 5.1.
CVE-2026-49820 is an open redirect vulnerability in the Probo GRC platform's saferedirect package prior to version 0.193.1. The flaw allows crafted URLs with backslashes to bypass validation and redirect users to external malicious sites. This can be exploited in authentication flows to facilitate phishing attacks. The issue is fixed in version 0.193.1 by normalizing paths and rejecting backslashes. Self-hosted deployments should upgrade to version 0.194.1 or later. SaaS deployments are already patched. No practical workaround exists for self-hosted users.
The Meeting Room Booking System (MRBS) is a PHP-based application for booking meeting rooms. Prior to version 1.12.2, an unauthenticated request can be made to redirect the user to a query-specified location. This allows an attacker to create a specially-crafted URL to an MRBS installation that will cause the user who clicks it to be redirected to the attacker-specified redirect URL, which could be a spoofed MRBS login page, for example. Version 1.12.2 contains a fix. No known workarounds are available.