CWE-601: URL Redirection to Untrusted Site
The web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a redirect.
Also known as Open Redirect, Cross-site Redirect, Cross-domain Redirect.
A kind of CWE-610 Externally Controlled Reference to a Resource in Another Sphere.
From the CWE List. © The MITRE Corporation.
Newest
- angularAngular: Open Redirect via Protocol-Relative URLs in Server-Side Rendering (SSR)5.1 Medium
- optimal idm optimalcloudOptimal IdM OptimalCloud social redirect5.3 Medium
- antoinersx clawhostantoinersx clawhost Reverse Proxy reverseProxy.ts handleRequest redirect5.3 Medium
- diem-project diemdiem-project diem Sign-In BasedmUserActions.class.php redirect5.3 Medium
- aircheng-org iwebshop-5aircheng-org iWebShop-5 Login Redirect _userInfo.php redirect5.3 Medium
- unknown otter blocksOtter Blocks < 3.2.3 - Unauthenticated Open Redirect via Stripe Checkout Block5.4 Medium
- coderCoder 2.0.0 before 2.34.8 Open Redirect via Workspace App Proxy5.3 Medium
- patreon wordpress, unknown patreon wordpress +1 morePatreon WordPress < 1.10.0 - Open Redirect via 'state' Parameter4.3 Medium
- a466350665 smart-ssosmart-sso through 2.1.1 OAuth2 Authorization Code Theft via Unvalidated redirectUri7.6 High
- checkmk gmbh checkmkOpen redirect and XSS via reset_url parameter8.6 High
- nezhahq nezhaNezha 2.1.0 before 2.3.15 Host Header Injection via MCP Transfer Tools6.3 Medium
- erudika scooldScoold: Open Redirect in getBackToUrl() allows phishing via domain-prefix startsWith bypass5.4 Medium
- eclipse foundation adoptium temurinIn the Eclipse Adoptium website (adoptium.net), in every deployment built from commit 0b24ea1 ...7.5 High
- creema ltd. "creema - handmade marketplace app" for ios, "handmade marketplace app - creema" for android +1 more"Handmade Marketplace App - Creema" provided by CREEMA LTD. contains an open redirect...5.1 Medium
- gogsGogs: Open Redirect in /redirect endpoint via backslash bypass in `IsSameSite`5.3 Medium
- auth0 nextjs-auth0Improper Validation of Post-Login Redirect URL in nextjs-auth06.1 Medium
- microsoft windows 10 version 1607, windows 10 version 1809, windows server 2016 +8 more +10 moreActive Directory Federation Services (AD FS) Spoofing Vulnerability6.5 Medium
- microsoft windows 10 version 1607, windows 10 version 1809, windows server 2016 +8 more +10 moreActive Directory Federation Services (AD FS) Spoofing Vulnerability4.8 Medium
- microsoft windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 +22 more +24 moreWindows BitLocker Security Feature Bypass Vulnerability6.1 Medium
- elated-themes frappeFrappe: Open Redirect via Unsanitized OAuth State Param.5.1 Medium
- sanluan publiccmsPublicCMS pay Endpoint SafeConfigComponent.java SafeConfigComponent.getSafeUrl redirect5.3 Medium
- gitlabURL Redirection to Untrusted Site ('Open Redirect') in GitLab5.8 Medium
- sap se netweaver enterprise portalOpen Redirect Vulnerability in SAP NetWeaver Enterprise Portal6.1 Medium
- convoypanel panelHoloViz Panel from 1.2.2 before 1.9.0 Open Redirect via next Parameter5.1 Medium
- apache software foundation alluraApache Allura: OAuth1 missing callback validation9.1 Critical
- theliaCVE-2026-1035236.1 Medium
- @tinacms app, tinacms +1 moreTinaCMS admin preview iframe loads an attacker-controlled origin from the URL fragment9.3 Critical
- apache cxfApache CXF: OIDC RP Open Redirect6.1 Medium
- adonisjs http-serverAdonisJS: Unencoded route parameters can produce open redirects6.1 Medium
- arista networks cloudvision portalSecurity Advisory 01877.6 High
- arista networks cloudvision portalSecurity Advisory 01875.3 Medium
- google chromeOpen redirect in AppManifest in Google Chrome prior to 155.0.8059.39 allowed a remote attacker...6.1 Medium
- payloadcms payload, @payloadcms next +1 morePayload: Untrusted redirect URL parameter exploit6.1 Medium
- ping identity pinggatewayOpen Redirect in PingGateway Fragment Filter5.1 Medium
- svenbluege event gallery, svenbluege.de event gallery for joomla +1 moreJoomla Extension - svenbluege.de - Cross-site scripting and open redirect on the share mini page in Event Gallery extension < 6.6.05.3 Medium
- laradashboardLaraDashboard before 1.4.8 Open Redirect via Email Template Builder redirect_url5.3 Medium
- mehul gohil aculect ai companionWordPress Aculect AI Companion plugin <= 0.8.2 - Unvalidated Redirects and Forwards vulnerability4.7 Medium
- syed balkhi giveaways and contests by rafflepressGiveaways and Contests by RafflePress < 1.12.27 - Unauthenticated Stored Open Redirect via 'parent_url' Parameter6.1 Medium
- red hat openshift container platform 4.12, openshift container platform 4.13, openshift container platform 4.14 +9 more +11 moreOauth-proxy: open redirect via /\ and /\t bypass in post-login redirect6.1 Medium
- accellion kiteworks, kiteworks core +1 moreKiteworks Core content injection4.3 Medium
- unknown safe redirect managerSafe Redirect Manager < 2.3.0 - Open Redirect via Wildcard Redirect Rules3.4 Low
- the wikimedia foundation mediawiki - collection extensionOpen Redirect in Special:Book6.1 Medium
- finsys dockhandDockhand < 1.0.36 Open Redirect via OIDC Initiation Endpoint5.3 Medium
- dell secure connect gateway (scg) policy manager, policy manager for secure connect gateway +1 moreDell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an URL...5.4 Medium
- hewlett packard enterprise hpe oneviewHPE OneView - URL Redirect vulnerability4.3 Medium
- axiosAxios: maxRedirects: 0 is not enforced by the fetch adapter, allowing redirect-based SSRF7.0 High
- svenbluege event gallery, svenbluege.de event gallery for joomla +1 moreJoomla Extension - svenbluege.de - Reflected XSS and open redirect in Event Gallery extension < 6.5.05.3 Medium
- cotontiCotonti through 1.0.0 Open Redirect via message.php redirect parameter5.1 Medium
- yunaiv ruoyi-vue-proYunaiV/zhijiantianya ruoyi-vue-pro OAuth2 Client OAuth2ClientServiceImpl.java validOAuthClientFromCache redirect5.3 Medium
- edimax br-6428ncEdimax BR-6428nC goform websRedirect redirect5.3 Medium
- Show moreLoading…