CWE-601: URL Redirection to Untrusted Site
The web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a redirect.
Also known as Open Redirect, Cross-site Redirect, Cross-domain Redirect.
A kind of CWE-610 Externally Controlled Reference to a Resource in Another Sphere.
From the CWE List. © The MITRE Corporation.
Newest
- openidentityplatform openam OpenAM before 16.1.4 Open Redirect via WS-Federation and SAML v2.0 Pages 2.3 Low
- openidentityplatform openam OpenAM before 16.1.4 Open Redirect via SAML v2.0 RelayState 2.3 Low
- openidentityplatform openam OpenAM before 16.1.4 Open Redirect via SAML 1.x Trusted-Partner Matching 5.3 Medium
- ibm api connect Multiple Vulnerabilities in IBM API Connect 9.6 Critical
- ibm api connect Multiple Vulnerabilities in IBM API Connect 8.7 High
- jupyterlab jupyterlab-desktop JupyterLab Desktop: One-Click Jupyter Server Token Leak leading to Remote Code Execution 9.6 Critical
- hcl aion HCL AION is affected by multiple security vulnerabilities. 4.7 Medium
- hcl aion HCL AION is affected by multiple security vulnerabilities. 4.7 Medium
- hcl aion HCL AION is affected by multiple security vulnerabilities. 4.7 Medium
- hcl aion HCL AION is affected by multiple security vulnerabilities. 4.7 Medium
- hcl aion HCL AION is affected by multiple security vulnerabilities. 4.7 Medium
- hcl aion HCL AION is affected by multiple security vulnerabilities. 4.7 Medium
- open-emr openemr OpenEMR: Unauthenticated Open Redirect via OIDC End Session Endpoint 4.3 Medium
- opentext operations bridge manager, universal discovery and cmdb +1 more Open redirect vulnerability - UCMDB/Operations Bridge Manager 5.1 Medium
- ibm db2 genius hub Multiple vulnerabilities that affects IBM Db2 Genius Hub 3.4 Low
- sensiolabs symfony Symfony: HtmlSanitizer MetaRefreshAttributeSanitizer Matches Only a Narrow Subset of the Browser Refresh Grammar (Incomplete Fix for CVE-2026-48761) 5.3 Medium
-
libcgi-pm-perlDebian,perl-CGIAzure Linux +1 more CGI versions before 5.00 for Perl allow open redirects via HTML entity decoding of the URL after application validation in redirect No score -
libcgi-pm-perlDebian,perl-CGIAzure Linux +1 more CGI versions before 5.00 for Perl allow open redirects and script injection via URLs built from REQUEST_URI in url and start_form No score -
libcgi-pm-perlDebian,perl-CGIAzure Linux +1 more CGI versions before 5.00 for Perl trust the client X-Forwarded-Host header in url, self_url, virtual_host and virtual_port No score - mongodb atlas sql jdbc driver Atlas SQL JDBC Driver <=4.0.0: OIDC discovery endpoints not scheme-validated - attacker-controlled URI dispatched to OS protocol handler 5.1 Medium
- typo3 extension "mail" Open Redirection in extension "Mail" (mail) 5.3 Medium
- wso2 identity server Open Redirect via Callback URL Validation in WSO2 Products Allows Phishing Attacks 4.3 Medium
- wso2 api manager, carbon registry kernel, enterprise integrator +4 more +6 more Open Redirection via Unsanitized User Input in Multiple WSO2 Products Allows Phishing Attacks 5.4 Medium
- red hat build of keycloak, single sign-on 7 +1 more Keycloak-services: keycloak-services: redirect uri domain allowlist bypass via dns resolution to loopback 6.8 Medium
- No product listed An issue in the activity.LoadLinkLaterActivity component of FeedEx / Handy News Reader... 7.5 High
- labstack echo Echo: Arbitrary Scheme Injection in WWWRedirect/NonWWWRedirect Middlewares via X-Forwarded-Proto 4.7 Medium
- labstack echo Echo: Open Redirect via Control-Character Prefix Defeating sanitizeURI 6.1 Medium
- nanbu welcart e-commerce Welcart e-Commerce < 2.12.6 - Unauthenticated Open Redirect via 'usces_referer' Parameter 4.7 Medium
- mozilla thunderbird Matrix homeserver could redirect the chat session to a local file or network share 7.5 High
- mozilla thunderbird Calendar discovery accepted local file and remote network share locations 9.1 Critical
- umbraco umbraco-cms Umbraco CMS before 17.7.2 and 18.2.2 Account Takeover via Host Header Poisoning 7.7 High
- tornadoweb tornado Tornado: Open redirect in RedirectHandler via protocol-relative URLs 2.1 Low
- nosduco nforwardauth nforwardauth: Unvalidated r parameter allows post-authentication open redirect 6.1 Medium
- No product listed An Open Redirect vulnerability exists in the public form submission endpoint (/form/submit) of Mautic. After a form is submitted, the application redirects the visitor to a return address supplied wit… 5.4 Medium
- gedelumbung hospitalmanagement gedelumbung HospitalManagement URL Validation routing_pages.php simpan redirect 5.3 Medium
- authlib Authlib: is_secure_transport() loopback exemption can be bypassed with a userinfo component, allowing cleartext-HTTP URLs to non-loopback hosts 2.6 Low
- openbao OpenBao before 2.6.3 Open Redirect via OIDC Identity Provider UI 5.3 Medium
- No product listed An issue in Webasyst Framework 4.0.3 and before allows a remote attacker to execute arbitrary... 8.1 High
- wso2 api manager Open Redirection via Callback URL in WSO2 API Manager Allows Phishing Attacks 5.4 Medium
- sveltejs kit SvelteKit before 3.0.0 Open Redirect via Enhanced Form Actions 2.1 Low
- oracle corporation bi publisher Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component: BI Platform... 8.8 High
- oracle corporation business intelligence enterprise edition Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics ... 7.8 High
- oracle corporation bi publisher Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component: Web Server). ... 4.7 Medium
- oracle corporation jd edwards enterpriseone tools Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: E1... 5.4 Medium
- oracle siebel crm, oracle corporation siebel crm end user +1 more Vulnerability in the Siebel CRM End User product of Oracle Siebel CRM (component: Open UI). ... 4.3 Medium
- oracle corporation jd edwards enterpriseone tools Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component:... 7.8 High
- oracle jdeveloper Vulnerability in the Oracle JDeveloper product of Oracle Fusion Middleware (component: Security... 6.5 Medium
- oracle jd edwards enterpriseone tools Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component:... 8.8 High
- oracle corporation applications framework Vulnerability in the Oracle Applications Framework product of Oracle E-Business Suite (component:... 6.5 Medium
- oracle corporation siebel apps - marketing Vulnerability in the Siebel Apps - Marketing product of Oracle Siebel CRM (component: Email... 5.9 Medium
- Show olderLoading…