CWE-601: URL Redirection to Untrusted Site
The web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a redirect.
Also known as Open Redirect, Cross-site Redirect, Cross-domain Redirect.
A kind of CWE-610 Externally Controlled Reference to a Resource in Another Sphere.
From the CWE List. © The MITRE Corporation.
Newest
- oracle enterprise manager base platformVulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager...8.8 High
- universal software inc. flexcityOpen Redirect in Universal Sotware's FlexCity6.1 Medium
- trinodb trinotrinodb trino OAuth2/OIDC ExternalUriInfo.java redirect5.3 Medium
- withastro astro@astrojs/node: Backslash-prefixed paths not recognized as internal by trailing-slash redirect2.1 Low
- calcom cal.diycal.diy 6.2.0 Conferencing OAuth Callback Open Redirect via Unsigned State5.3 Medium
- hikashop.com hikashop extension for joomlaJoomla Extension - hikashop.com - Open redirect in Hikashop < 6.5.26.1 Medium
- datacycle-engine datacycle-coredataCycle User API Password Reset And Confirmation Flows Trust Attacker- Controlled Redirect Targets7.3 High
- libgit2libgit2: HTTP transport can leak credentials to an offsite redirect target6.5 Medium
- ibm engineering ai hubMultiple Vulnerabilities in IBM Engineering AI hub.4.3 Medium
- ibm security verify access, security verify access container, verify identity access +1 more +3 moreSecurity vulnerabilities have been found in IBM Verify Identity Access and IBM Security Verify Access3.1 Low
- signozSigNoz < 0.134.0 SSO OAuth State Manipulation Session Token Theft7.6 High
- qt axivionURL Redirection to Untrusted Site ('Open Redirect') vulnerability in the Dashboard OAuth/OIDC implementation of Axivion6.8 Medium
- getredash redashRedash: Open redirect vulnerability in post-login redirect handling6.1 Medium
- getgrav grav-plugin-apiGrav API Plugin before 1.0.4 Password Reset Token Poisoning via admin_base_url9.4 Critical
- adobe commerce, commerce b2b, commerce events +4 more +6 moreAdobe Commerce | URL Redirection to Untrusted Site ('Open Redirect') (CWE-601)6.1 Medium
- ivanti xtractionAn open redirect in Ivanti Xtraction before version 2026.2.1 allows a remote unauthenticated...4.0 Medium
- sap approuterOpen Redirect vulnerability in SAP Approuter8.1 High
- grokability snipe-itSnipe-IT: Open Redirect After User Edit6.1 Medium
- authorizerdev authorizerAuthorizer: Unvalidated redirect_uri in /authorize leaks OAuth2 tokens to attacker-controlled URL9.3 Critical
- caronc appriseApprise forwards configured auth headers across cross-origin HTTP redirects3.1 Low
- openrundev openrunOpenRun: Redirect URL validation bypass using //host paths leads to Open Redirect5.1 Medium
- hashgraph guardian, nozomi networks cmc, siemens ruggedcom ape1808 +2 moreOpen Redirect in SAML Single Sign-On in Guardian/CMC before 26.2.05.3 Medium
- wakujs wakuWaku: Open Redirect via `unstable_redirect` Helper3.1 Low
- gradio-app gradioGradio < 6.20.0 - Open Redirect and SSRF via /gradio_api/file= endpoint4.9 Medium
- better-authbetter-auth before 1.6.13 Stored XSS via javascript redirect_uri5.1 Medium
- kiwitcms kiwiKiwi TCMS: Open Redirect via unvalidated next parameter in account confirmation endpoint6.1 Medium
- coderCoder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps7.7 High
- ciliumCiliumLocalRedirectPolicy addressMatcher allows cross-namespace service traffic hijacking and can break service translation6.9 Medium
- codeigniter ecommerce-codeigniter-bootstrapkirilkirkov Ecommerce-CodeIgniter-Bootstrap Trusted Backend MY_Controller.php setReferrer redirect5.3 Medium
- microsoft 365 copilotMicrosoft 365 Copilot Elevation of Privilege Vulnerability9.3 Critical
- openclawOpenClaw < 2026.6.5 Authorization Header Forwarding via SSE6.0 Medium
- concourseConcourse login flow has an open redirect issue0.0 None
- mediawiki, the wikimedia foundation mediawiki - urlshortener extension +1 moreUrlShortener defaults to ineffective validation open to third-party redirects6.9 Medium
- invoiceninjaInvoice Ninja 5.13.26 - Open Redirect in Client Portal Login via intended Parameter5.3 Medium
- tp-link systems inc. archer ax20 v2.0Unauthenticated Open Redirect Vulnerability on TP-Link Archer AX20 Web Interface5.9 Medium
- getprobo proboProbo has an open redirect bypass via path normalization4.7 Medium
- cactiCacti: Open Redirect via HTTP_REFERER substring check in auth_login_redirect6.1 Medium
- mailerupLack of input validation in Mailerup input parameter leads to Open Redirect5.3 Medium
flask-securityPyPIFlask-Security has an Open Redirect issue4.7 Medium- poweradminPoweradmin has Host Header Injection in OIDC redirect_uri, SAML ACS/SLO URL, and Logout Redirect Construction.9.6 Critical
- immich-app immichimmich: One-click account takeover via XSS in login page continue redirect9.6 Critical
- gogsGogs: Open Redirect via redirect_to in Gogs5.4 Medium
- pretix venuelessOpen redirect5.1 Medium
lemonldap-ngDebianlemonldap-ng SAML Common Domain Cookie Endpoint CDC.pm redirect5.3 Medium- cap-go capgoCapgo - Open Redirect via confirmation_url Parameter5.1 Medium
- cap-go capgoCapgo - Open Redirect via Unvalidated Stripe Billing URLs4.8 Medium
- miniflux v2Miniflux 2: Open Redirect Bypass5.1 Medium
- tinacms @tinacms/app, tinacms +1 moreTinaCMS: Cross-origin postMessage handlers and rich-text URL-sanitization bypass enable stored XSS and session takeover7.6 High
- microsoft 365 copilotMicrosoft 365 Copilot's Business Chat Elevation of Privilege Vulnerability8.8 High
- microchip gridtime 3000, gridtime 3000 firmware +1 moreOpen Redirect Vulnerability in Password Reset Submission in GridTime™ 3000 GNSS Time Server5.3 Medium
- Show moreLoading…