CWE-601: URL Redirection to Untrusted Site
The web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a redirect.
Also known as Open Redirect, Cross-site Redirect, Cross-domain Redirect.
A kind of CWE-610 Externally Controlled Reference to a Resource in Another Sphere.
From the CWE List. © The MITRE Corporation.
Newest
- apache apisixApache APISIX: Cas-auth Host header influence on CAS service URL2.1 Low
- apache apisixApache APISIX: Cas-auth plugin open redirect via unsanitized cookie value2.1 Low
- pgadmin 4, pgadmin.org pgadmin 4 +1 morepgAdmin 4: Open redirect in multi-factor authentication flow via unvalidated 'next' parameter5.3 Medium
- significant-gravitas autogptAutoGPT SignUp Page has DOM-Based XSS and Open Redirect8.8 High
- drupal, drupal core +1 moreDrupal core - Less critical - Cache poisoning and open redirect - SA-CORE-2026-0075.9 Medium
- cakephp authentication, cakephp +1 moreCakePHP: Open redirect weakness via backslash bypass5.1 Medium
- gitea open source git serverGitea redirect handling permits open redirects through backslash paths6.1 Medium
- cisco webex app, webex web app +1 moreA vulnerability in the browser-based version of Cisco Webex App could have allowed an...4.3 Medium
- dell powerflex rack, powerflex rack release certification matrix +1 moreDell PowerFlex rack, version(s) RCM 3.7/3.7, contain(s) a Host Header Injection vulnerability. An...4.3 Medium
- one identity password manager, password manager manager +1 moreOpen redirection vulnerability in Password Manager5.1 Medium
- one identity password manager, password manager manager +1 moreOpen redirection vulnerability in Password Manager5.1 Medium
- oracle human resourcesVulnerability in the Oracle Human Resources product of Oracle E-Business Suite (component: Person...7.5 High
- oracle isupplier portalVulnerability in the Oracle iSupplier Portal product of Oracle E-Business Suite (component: Home...8.0 High
- oracle webcenter contentVulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component:...8.2 High
- oracle webcenter sitesVulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware (component:...8.0 High
- oracle weblogic serverVulnerability in the WebLogic Server product of Oracle Fusion Middleware (component: Console). ...8.3 High
- oracle weblogic serverVulnerability in the WebLogic Server product of Oracle Fusion Middleware (component: Console). ...8.8 High
- oracle weblogic serverVulnerability in the WebLogic Server product of Oracle Fusion Middleware (component: Console). ...8.7 High
- @clerk nuxtNuxt - Cross-Site Scripting via navigateTo open Option5.3 Medium
- @clerk nuxtNuxt - Open Redirect via Protocol-Relative Paths in reloadNuxtApp5.3 Medium
- @clerk nuxtNuxt - Server-Side Open Redirect via Path-Normalization Bypass in navigateTo5.3 Medium
- aio-libs aiohttpAIOHTTP: DigestAuthMiddleware Applies Credentials to Cross-Origin Redirect Challenges6.3 Medium
- sensiolabs symfony, cloud foundry routing +1 moreSymfony: UrlGenerator Dot-Segment Encoding Skips Every Other Chained `../` or `./` → Generated URL Collapses Off-Route Under RFC 3986 Normalization5.1 Medium
- nezhahq nezhaNezha Monitoring: OAuth2 Redirect URL — Host Header Injection6.8 Medium
- aqara iam/sso gateway, iam\/sso gateway +1 moreAqara IAM/SSO Gateway open redirect6.1 Medium
- roxy-wiRoxy-WI: Open redirect on /login?next= via basic-auth userinfo syntax bypass6.1 Medium
- erlang otp, erlang\/inets, erlang\/otp +2 morehttpc leaks Authorization header to cross-origin redirect targets7.1 High
- jenkinsJenkins: Open Redirect phishing attacks possible via "from" parameter in "Delegate to servlet container"4.3 Medium
- jenkins, red hat openshift developer tools and services 4.12, openshift developer tools and services 4.13 +9 more +11 moreJenkins Open Redirect Through Newline/Tab Characters in Redirect URL4.3 Medium
- jenkinsJenkins Open Redirect via Relative Path Segments in Post-Login Redirect URL4.3 Medium
- spring security, vmware spring security +1 moreOpen Redirect When Using CookieRequestCache6.1 Medium
- broadcom spring authorization server, spring authorization server, security +1 more +3 moreSpring Security Authorization Server Open Redirect via request_uri6.1 Medium
- adobe experience manager, experience manager 6.5, experience manager 6.5 lts +1 more +3 moreAdobe Experience Manager | URL Redirection to Untrusted Site ('Open Redirect') (CWE-601)6.1 Medium
- solarwinds observability self-hostedSolarWinds Observability Self-Hosted Open Redirect Vulnerability4.8 Medium
- typo3 cmsTYPO3 CMS - Open Redirect in Core Utilities5.3 Medium
- spring framework, vmware spring framework +1 moreSpring Framework Open Redirect in Spring MVC and WebFlux4.2 Medium
- authlibAuthlib OAuth 2.0 authorization endpoint open redirects to attacker-controlled redirect_uri on unsupported response_type5.4 Medium
- No product listedJeecgBoot Third-Party Login ThirdLoginController.java HttpServletResponse.sendRedirect redirect2.3 Low
- hs-web hsweb-frameworkhs-web hsweb-framework OAuth2 Client OAuth2Client.java OAuth2Client redirect5.3 Medium
- nocodbNocoDB: Open Redirect via Hash Fragment in hashRedirect Plugin5.1 Medium
- hcltech digital experience, digital experience compose, hclsoftware digital experience & dx compose +2 moreHCL Digital Experience and HCL Digital Experience Compose could be susceptible to Host header injection6.1 Medium
- runzero platform, shopware +1 moreShopware SSO referer trust leading to an arbitrary redirect target4.3 Medium
- pylons webobWebOb: Location header normalization during redirect leads to open redirect6.1 Medium
- mispMISP post-login open redirect via pre_login_requested_url5.1 Medium
- mispOpen redirect in MISP dashboard button widget URL handling5.1 Medium
- fossbillingFOSSBilling has an open redirect via administrator-configured redirect targets4.8 Medium
- goauthentik authentikauthentik: WS-Federation wreply origin bypass can exfiltrate signed login responses to attacker-controlled endpoints6.9 Medium
- @tanstack react-router, remix-run @remix-run/router +1 moreReact Router's same-origin redirect with path starting // causes open redirect via protocol-relative URL reinterpretation6.6 Medium
- nextcloud user oidc, kiteworks security-advisories +1 moreNextcloud: Open Redirect in user_oidc login flow via protocol-relative URL bypass3.3 Low
- apache airflowApache Airflow: Open Redirect Bypass Vulnerability7.2 High
- Show moreLoading…