CVE-2020-35678
Open Redirect in autobahn
Autobahn|Python before 20.12.3 allows redirect header injection.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
Autobahn|Python before 20.12.3 allows redirect header injection.
- Record
CVE-2020-35678- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - CVSS 2.0
- 5.8 Medium
AV:N/AC:M/Au:N/C:P/I:P/A:N - Weakness
- CWE-601
- Updated
- 2026-11-02
CVE List No score
Autobahn|Python before 20.12.3 allows redirect header injection.
- Record
CVE-2020-35678- Updated
- 2026-11-02
EUVDEUVD-2020-0049 No score
Autobahn|Python before 20.12.3 allows redirect header injection.
- Record
EUVD-2020-0049- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-gwp7-vqr5-h33h
Open Redirect in autobahn
Autobahn|Python before 20.12.3 allows redirect header injection.
- Record
GHSA-gwp7-vqr5-h33h- CVSS 4.0
- 5.3 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N - CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-601
- Updated
- 2026-11-02
OSV
Autobahn|Python before 20.12.3 allows redirect header injection.
- Record
CVE-2020-35678- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Updated
- 2026-11-02
OSVDEBIAN-CVE-2020-35678
Autobahn|Python before 20.12.3 allows redirect header injection.
- Record
DEBIAN-CVE-2020-35678- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Updated
- 2026-11-02
Show 10 moreShow less
OSVGHSA-gwp7-vqr5-h33h
Open Redirect in autobahn
Autobahn|Python before 20.12.3 allows redirect header injection.
- Record
GHSA-gwp7-vqr5-h33h- CVSS 4.0
- 5.3 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N - CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-601
- Updated
- 2026-11-02
OSVUBUNTU-CVE-2020-35678
Autobahn|Python before 20.12.3 allows redirect header injection.
- Record
UBUNTU-CVE-2020-35678- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Updated
- 2026-11-02
OSVopenSUSE-SU-2021:0132-1 No score
Security update for python-autobahn
This update for python-autobahn fixes the following issue:
- CVE-2020-35678: Fixed a redirect header injection (boo#1180570).
- Record
openSUSE-SU-2021:0132-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2021:0152-1 No score
Security update for python-autobahn
This update for python-autobahn fixes the following issue:
- CVE-2020-35678: Fixed a redirect header injection (boo#1180570).
This update was imported from the openSUSE:Leap:15.1:Update update project.
- Record
openSUSE-SU-2021:0152-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2021:0176-1 No score
Security update for python-autobahn
This update for python-autobahn fixes the following issue:
- CVE-2020-35678: Fixed a redirect header injection (boo#1180570).
This update was imported from the openSUSE:Leap:15.1:Update update project. This update was imported from the openSUSE:Leap:15.2:Update update project.
- Record
openSUSE-SU-2021:0176-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2021:0180-1 No score
Security update for python-autobahn
This update for python-autobahn fixes the following issue:
- CVE-2020-35678: Fixed a redirect header injection (boo#1180570).
This update was imported from the openSUSE:Leap:15.1:Update update project.
- Record
openSUSE-SU-2021:0180-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:11216-1 No score
python38-autobahn-21.3.1-1.3 on GA media
These are all security issues fixed in the python38-autobahn-21.3.1-1.3 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:11216-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:13902-1 No score
python310-autobahn-23.6.2-3.1 on GA media
These are all security issues fixed in the python310-autobahn-23.6.2-3.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:13902-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2026:11780-1 No score
python313-autobahn-26.7.1-1.1 on GA media
These are all security issues fixed in the python313-autobahn-26.7.1-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2026:11780-1- Updated
- 2026-11-02
OSVPYSEC-2020-25 No score
Autobahn|Python before 20.12.3 allows redirect header injection.
- Record
PYSEC-2020-25- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
autobahnPyPI |
before 20.12.3 | 20.12.3 |
python-autobahnDebian:12 |
before 17.10.1+dfsg1-7 | 17.10.1+dfsg1-7 |
python-autobahnDebian:13 |
before 17.10.1+dfsg1-7 | 17.10.1+dfsg1-7 |
python-autobahnDebian:14 |
before 17.10.1+dfsg1-7 | 17.10.1+dfsg1-7 |
autobahnPyPI |
before 20.12.3, plus listed versions 0.10.00.10.10.10.20.10.30.10.4 Show 45 moreShow less0.10.50.10.5.post20.10.60.10.70.10.80.10.90.11.00.12.00.12.10.13.00.13.10.14.00.14.10.15.00.16.00.16.10.17.00.17.10.17.20.18.00.18.10.18.20.3.10.3.20.4.00.4.10.4.100.4.20.4.30.5.00.5.10.5.140.5.20.5.50.5.80.5.90.6.30.6.40.6.50.7.00.7.10.7.20.7.30.7.40.8.0 |
20.12.3 |
autobahnPyPI |
before 20.12.3, plus listed versions 0.3.10.3.20.4.00.4.10.4.2 Show 45 moreShow less0.4.30.4.100.5.00.5.10.5.20.5.50.5.80.5.90.5.140.6.30.6.40.6.50.7.00.7.10.7.20.7.30.7.40.8.00.8.10.8.20.8.30.8.40.8.4-20.8.4-30.8.50.8.60.8.70.8.80.8.90.8.100.8.110.8.120.8.130.8.140.8.150.9.00.9.10.9.20.9.30.9.3-20.9.3-30.9.40.9.4-20.9.50.9.6 |
20.12.3 |
python-autobahnUbuntu:16.04:LTS |
All versions, plus listed versions 0.10.3+dfsg1-20.10.3+dfsg1-30.10.3+dfsg1-5 |
None known |
python-autobahnUbuntu:18.04:LTS |
All versions, plus listed versions 0.14.1+dfsg1-2ubuntu117.10.1+dfsg1-2 |
None known |
python-autobahnUbuntu:20.04:LTS |
All versions, plus listed versions 17.10.1+dfsg1-517.10.1+dfsg1-6 |
None known |
python-autobahnUbuntu:22.04:LTS |
All versions, plus listed versions 17.10.1+dfsg1-721.11.1+dfsg1-221.11.1+dfsg1-2build1 |
None known |
Show 11 moreShow less
| Package | Affected | Fixed |
|---|---|---|
python-autobahnUbuntu:24.04:LTS |
All versions, plus listed versions 22.7.1+dfsg1-322.7.1+dfsg1-4 |
None known |
python-autobahnUbuntu:25.10 |
All versions, plus listed versions 23.1.2+dfsg1-2 |
None known |
python-autobahnUbuntu:26.10 |
All versions, plus listed versions 24.4.2+dfsg1-5 |
None known |
python-autobahnUbuntu:26.04:LTS |
All versions, plus listed versions 23.1.2+dfsg1-224.4.2+dfsg1-424.4.2+dfsg1-5 |
None known |
python-autobahnopenSUSE:Leap 15.1 |
before 17.10.1-lp151.3.3.1 | 17.10.1-lp151.3.3.1 |
python-autobahnopenSUSE:Leap 15.2 |
before 17.10.1-lp152.4.3.1 | 17.10.1-lp152.4.3.1 |
python-autobahnSUSE:Package Hub 15 SP2 |
before 17.10.1-bp152.4.3.1 | 17.10.1-bp152.4.3.1 |
python-autobahnSUSE:Package Hub 15 SP1 |
before 17.10.1-bp151.4.3.1 | 17.10.1-bp151.4.3.1 |
python-autobahnopenSUSE:Tumbleweed |
before 21.3.1-1.3 | 21.3.1-1.3 |
python-autobahnopenSUSE:Tumbleweed |
before 23.6.2-3.1 | 23.6.2-3.1 |
python-autobahnopenSUSE:Tumbleweed |
before 26.7.1-1.1 | 26.7.1-1.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2020-35678 is a medium vulnerability (CVSS 6.1) in Crossbar Autobahn, published December 27, 2020. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.44%, the 73rd percentile. Fixed in autobahn 20.12.3.
References
github.com/crossbario/autobahn-python
pypi.org/project/autobahn/20.12.3
autobahn.readthedocs.io/en/latest/changelog.html
nvd.nist.gov/vuln/detail/CVE-2020-35678
Show 12 moreShow less
security-tracker.debian.org/tracker/CVE-2020-35678
ubuntu.com/security/CVE-2020-35678
cve.org/CVERecord?id=CVE-2020-35678
lists.opensuse.org/archives/list/[email protected]/thread/HC22UZIJVKS65SOAIGLLU6XWHC73XYOM
bugzilla.suse.com/1180570
suse.com/security/cve/CVE-2020-35678
Left out here: 160 versions. The JSON record has them.