Search: CVE-2026-116578

CVE-2026-116578 is an open redirect vulnerability in the Tornado Python web framework prior to version 6.6. The issue arises from tornado.web.RedirectHandler URL templates that allow regex-capture substitutions in certain positions, enabling crafted request paths to change the redirect scheme or network location. This can lead to attacker-controlled redirects on the application's domain, which can be exploited for phishing attacks. The vulnerability is fixed in Tornado version 6.6.