Weakness (CWE)
CWE-601: URL Redirection to Untrusted Site
The web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a redirect.
How to prevent it (6 mitigations)
-
Implementation
Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does.
When performing input validation, consider all potentially relevant properties, including length, type of input, the full range of acceptable values, missing or extra inputs, syntax, consistency across related fields, and conformance to business rules. As an example of business rule logic, "boat" may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as "red" or "blue."
Do not rely exclusively on looking for malicious or malformed inputs. This is likely to miss at least one undesirable input, especially if the code's environment changes. This can give attackers enough room to bypass the intended validation. However, denylists can be useful for detecting potential attacks or determining which inputs are so malformed that they should be rejected outright.
Use a list of approved URLs or domains to be used for redirection.
-
Architecture and Design
Use an intermediate disclaimer page that provides the user with a clear warning that they are leaving the current site. Implement a long timeout before the redirect occurs, or force the user to click on the link. Be careful to avoid XSS problems (CWE-79) when generating the disclaimer page.
-
Architecture and Design
When the set of acceptable objects, such as filenames or URLs, is limited or known, create a mapping from a set of fixed input values (such as numeric IDs) to the actual filenames or URLs, and reject all other inputs.
For example, ID 1 could map to "/login.asp" and ID 2 could map to "http://www.example.com/". Features such as the ESAPI AccessReferenceMap [REF-45] provide this capability.
-
Architecture and Design
Ensure that no externally-supplied requests are honored by requiring that all redirect requests include a unique nonce generated by the application [REF-483]. Be sure that the nonce is not predictable (CWE-330).
-
Architecture and Design, Implementation
Understand all the potential areas where untrusted inputs can enter your software: parameters or arguments, cookies, anything read from the network, environment variables, reverse DNS lookups, query results, request headers, URL components, e-mail, files, filenames, databases, and any external systems that provide data to the application. Remember that such inputs may be obtained indirectly through API calls.
Many open redirect problems occur because the programmer assumed that certain inputs could not be modified, such as cookies and hidden form fields.
-
Operation
Use an application firewall that can detect attacks against this weakness. It can be beneficial in cases in which the code cannot be fixed (because it is controlled by a third party), as an emergency prevention measure while more comprehensive software assurance measures are applied, or to provide defense in depth [REF-1481].
Source: MITRE CWE-601
1,068 results · Clear filters · Feed
-
Medium 5.4
Open Redirection via Callback URL in WSO2 API Manager Allows Phishing Attacks
The callback URL parameter in WSO2 API Manager fails to validate user-supplied input, allowing it to be controlled by malicious actors. Exploitation of this vulnerability could lead to users being redirected to attacker-controlled web pages. This can be used …
-
Medium 4.7
SvelteKit before 3.0.0 Open Redirect via Enhanced Form Actions
SvelteKit (@sveltejs/kit) before 3.0.0 contains an open redirect vulnerability in enhanced form actions (use:enhance) on routes accepting paths beginning with a double slash. Attackers can craft action paths starting with // that become protocol-relative URLs…
-
Medium 4.7
Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component: Web Server). Supported versions that a…
-
Medium 5.4
Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: E1 Dev Platform Tech - UNI…
-
Medium 4.3
Vulnerability in the Siebel CRM End User product of Oracle Siebel CRM (component: Open UI). Supported versions that are…
-
Medium 6.5
Vulnerability in the Oracle JDeveloper product of Oracle Fusion Middleware (component: Security Framework). Supported v…
-
Medium 6.5
Vulnerability in the Oracle Applications Framework product of Oracle E-Business Suite (component: Security). Supported …
-
Medium 5.9
Vulnerability in the Siebel Apps - Marketing product of Oracle Siebel CRM (component: Email Marketing). Supported versi…
-
Medium 4.3
Optimal IdM OptimalCloud social redirect
A flaw has been found in Optimal IdM OptimalCloud 5.0. This vulnerability affects unknown code of the file /v5.0/social. Executing a manipulation of the argument state can lead to open redirect. The attack can be executed remotely. The vendor was contacted ea…
-
Medium 4.3
antoinersx clawhost Reverse Proxy reverseProxy.ts handleRequest redirect
A vulnerability was detected in antoinersx clawhost up to 0.0.45. This affects the function handleRequest of the file apps/clawhostgo/src/main/services/reverseProxy.ts of the component Reverse Proxy. Performing a manipulation of the argument token results in …
-
Medium 4.3
diem-project diem Sign-In BasedmUserActions.class.php redirect
A vulnerability was determined in diem-project diem up to 116974edfb9a5b8bd69cb13586dc62bcdbb485ad. This affects an unknown part of the file dmCorePlugin/plugins/dmUserPlugin/modules/dmUser/lib/BasedmUserActions.class.php of the component Sign-In. This manipu…
-
Medium 4.3
aircheng-org iWebShop-5 Login Redirect _userInfo.php redirect
A weakness has been identified in aircheng-org iWebShop-5 up to 5.16. The impacted element is the function IController::redirect of the file plugins/_userInfo/_userInfo.php of the component Login Redirect. This manipulation of the argument callback causes ope…
-
Medium 5.4
Otter Blocks < 3.2.3 - Unauthenticated Open Redirect via Stripe Checkout Block
The Otter Blocks WordPress plugin before 3.2.3 does not validate that a user-supplied return URL belongs to the site before using it to build the return destination of a Stripe Checkout session, allowing unauthenticated attackers to redirect victims who compl…
-
Medium 4.3
Coder 2.0.0 before 2.34.8 Open Redirect via Workspace App Proxy
Coder from 2.0.0 before 2.34.8 contains an open redirect vulnerability in handleAPIKeySmuggling that allows attackers to redirect users externally via unsanitized r.URL.Path values. Attackers can craft links on trusted workspace app subdomains with paths begi…
-
Medium 4.3
Coder 2.3.1 before 2.16.1 Open Redirect via Login Page redirect Parameter
Coder 2.3.1 before 2.14.4, 2.15.x before 2.15.3, and 2.16.0 before 2.16.1 contains an open redirect vulnerability in the login page because the redirect query parameter is improperly sanitized. Attackers can craft a Coder login URL that, when clicked by a log…
-
Medium 4.3
Patreon WordPress < 1.10.0 - Open Redirect via 'state' Parameter
The Patreon WordPress plugin before 1.10.0 does not validate a user-supplied redirect destination before redirecting, allowing unauthenticated attackers to redirect visitors to an arbitrary external URL through a crafted link, which is useful for phishing.
-
Medium 6.8
smart-sso through 2.1.1 OAuth2 Authorization Code Theft via Unvalidated redirectUri
smart-sso through 2.1.1 contains an open redirect vulnerability in the /login handler that allows unauthenticated attackers to steal OAuth2 authorization codes by supplying an unvalidated redirectUri parameter. Attackers can send crafted /login links to users…
-
Medium 4.8
Nezha 2.1.0 before 2.3.15 Host Header Injection via MCP Transfer Tools
Nezha from 2.1.0 before 2.3.15 contains a host header injection vulnerability in mintTransferTool that builds fs.download_url and fs.upload_url transfer URLs from the unvalidated Host header. Attackers who control the Host header seen on a victim's MCP reques…
-
Medium 5.4
Scoold: Open Redirect in getBackToUrl() allows phishing via domain-prefix startsWith bypass
Scoold is a Q&A and a knowledge sharing platform for teams. Prior to 1.69.1, the getBackToUrl() method in src/main/java/com/erudika/scoold/utils/HttpUtils.java validates the backto and returnto parameters with Strings.CI.startsWith against the configured serv…
-
Medium 4.3
"Handmade Marketplace App - Creema" provided by CREEMA LTD. contains an open redirect vulnerability. When accessing a s…
-
Medium 5.3
Gogs: Open Redirect in /redirect endpoint via backslash bypass in `IsSameSite`
Gogs is an open source self-hosted Git service. Prior to 0.15.0+dev, an unauthenticated attacker can provide a backslash-containing target to the /redirect endpoint, and similar post-action redirect flows are also affected. internal/urlx/urlx.go IsSameSite va…
-
Medium 6.1
Improper Validation of Post-Login Redirect URL in nextjs-auth0
The auth0/nextjs-auth0 SDK validates that the returnTo parameter is a same-origin URL. The SDK then stores this value and, in a later step, reconstructs it for the post-authentication redirect. The reconstruction logic can produce a URL that browsers interpre…
-
Medium 6.5
Active Directory Federation Services (AD FS) Spoofing Vulnerability
Url redirection to untrusted site ('open redirect') in Active Directory Federation Services (AD FS) allows an unauthorized attacker to perform spoofing over a network.
-
Medium 4.8
Active Directory Federation Services (AD FS) Spoofing Vulnerability
Url redirection to untrusted site ('open redirect') in Active Directory Federation Services (AD FS) allows an authorized attacker to perform spoofing over a network.
-
Medium 6.1
Windows BitLocker Security Feature Bypass Vulnerability
Url redirection to untrusted site ('open redirect') in Windows BitLocker allows an unauthorized attacker to bypass a security feature with a physical attack.
-
Medium 5.1
Frappe: Open Redirect via Unsanitized OAuth State Param.
Frappe is a full-stack web application framework. Prior to 15.116.0 and 16.29.0, the OAuth login flow uses an unsanitized client-controlled state parameter to select post-authentication navigation, allowing a crafted state value to redirect a user to an attac…
-
Medium 4.3
PublicCMS pay Endpoint SafeConfigComponent.java SafeConfigComponent.getSafeUrl redirect
A vulnerability was determined in PublicCMS up to 5.202608.a. Affected by this issue is the function SafeConfigComponent.getSafeUrl of the file publiccms-core/src/main/java/com/publiccms/logic/component/config/SafeConfigComponent.java of the component pay End…
-
Medium 5.8
URL Redirection to Untrusted Site ('Open Redirect') in GitLab
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 13.11 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an authenticated user controlling a Kubernetes agent to cause sensiti…
-
Medium 6.1
Open Redirect Vulnerability in SAP NetWeaver Enterprise Portal
SAP NetWeaver Enterprise Portal does not sufficiently validate input to a certain portal component. An unauthenticated attacker could craft a malicious link that, when clicked by a victim, loads attacker-controlled content within the trusted application conte…
-
Medium 6.1
HoloViz Panel from 1.2.2 before 1.9.0 Open Redirect via next Parameter
HoloViz Panel from 1.2.2 before 1.9.0 contains an open redirect vulnerability in panel/auth.py that allows remote attackers to redirect users by supplying an unvalidated next query parameter. BasicLoginHandler and PasswordLoginHandler store the parameter in a…
-
Medium 6.1
CVE-2026-103523
Thelia v2.6.0 contains an open redirect vulnerability in its address creation workflow. After a user accesses a crafted URL and successfully submits the “Add New Address” form, the application redirects them to the URL specified in the `next` parameter. Becau…
-
Medium 6.1
Apache CXF: OIDC RP Open Redirect
Apache CXF’s OIDC relying-party component could redirect users to an attacker-controlled URL after successful authentication. The issue occurs because attacker-controlled state parameters are preserved and later used as redirect targets without validating tha…
-
Medium 6.1
AdonisJS: Unencoded route parameters can produce open redirects
AdonisJS HTTP Server is a package for handling HTTP requests in the AdonisJS framework. Prior to 8.2.3 and 9.3.0, AdonisJS HTTP Server inserts route parameter values into URLs without encodeURIComponent in the shared createURL() helper used by Router.makeUrl(…
-
Medium 4.3
Security Advisory 0187
Insufficient validation of request in login flow could allow a remote, unauthenticated attacker to craft a URL that, when clicked by a user, redirects the user's browser to an arbitrary external site upon completion of the authentication process.
-
Medium 6.1
Open redirect in AppManifest in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engine…
-
Medium 6.1
Payload: Untrusted redirect URL parameter exploit
Payload is a free and open source headless content management system. In versions from 3.40.0 before 3.88.0 and canary versions before 4.0.0-canary.27, an attacker can craft a redirect URL parameter that sends a guest user to an untrusted destination after th…
-
Medium 5.1
Open Redirect in PingGateway Fragment Filter
An open redirect vulnerability exists in the PingGateway Fragment Filter feature. This issue affects PingGateway versions 7.1.0 and later, 2023.2.0 through 2024.11.1, and 2025.3.0 through 2025.11.1. It is fixed in versions 2024.11.2, 2025.11.2, and 2026.3.0 (…
-
Medium 5.3
Joomla Extension - svenbluege.de - Cross-site scripting and open redirect on the share mini page in Event Gallery extension < 6.6.0
Joomla Extension - svenbluege.de - Cross-site scripting and open redirect on the share mini page in Event Gallery extension < 6.6.0 - The page a shared image link opens (the share mini page of the front end) can link the article the image was shared from when…
-
Medium 5.4
LaraDashboard before 1.4.8 Open Redirect via Email Template Builder redirect_url
LaraDashboard before 1.4.8 contains an open redirect vulnerability that allows remote attackers to redirect users by supplying an unvalidated redirect_url parameter to EmailTemplateController builder and builderEdit. Attackers can send crafted builder links t…
-
Medium 4.7
WordPress Aculect AI Companion plugin <= 0.8.2 - Unvalidated Redirects and Forwards vulnerability
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Mehul Gohil Aculect AI Companion aculect-ai-companion allows Phishing.This issue affects Aculect AI Companion: from n/a through 0.8.2.