Skip to main content

Open Redirect CVE-2025-6428

| EUVD-2025-28735 MEDIUM
URL Redirection to Untrusted Site (Open Redirect) (CWE-601)
2025-06-24 security@mozilla.org
Google Mozilla Open Redirect
4.3
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
4.3 MEDIUM
AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Ubuntu
MEDIUM
qualitative
SUSE
MEDIUM
qualitative
Red Hat
6.1 MEDIUM
qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
None
Integrity
Low
Availability
None

Lifecycle Timeline

5
Patch released
Mar 31, 2026 - 21:13 nvd
Patch available
EUVD ID Assigned
Mar 15, 2026 - 22:36 euvd
EUVD-2025-28735
Analysis Generated
Mar 15, 2026 - 22:36 vuln.today
PoC Detected
Jul 03, 2025 - 16:42 vuln.today
Public exploit code
CVE Published
Jun 24, 2025 - 13:15 nvd
MEDIUM 4.3

DescriptionCVE.org

When a URL was provided in a link querystring parameter, Firefox for Android would follow that URL instead of the correct URL, potentially leading to phishing attacks. *This bug only affects Firefox for Android. Other versions of Firefox are unaffected.* This vulnerability affects Firefox < 140.

Analysis

When a URL was provided in a link querystring parameter, Firefox for Android would follow that URL instead of the correct URL, potentially leading to phishing attacks. *This bug only affects Firefox for Android. Other versions of Firefox are unaffected.* This vulnerability affects Firefox < 140.

More from same product – last 7 days

CVE-2026-53523 MEDIUM
6.8 Jun 12

Host header injection in Nezha Monitoring versions 1.0.0 through 2.2.0 allows unauthenticated remote attackers to redire
CVE-2026-45566 MEDIUM
6.1 Jun 10

Open redirect in Roxy-WI versions 8.2.6.4 and prior allows unauthenticated remote attackers to silently redirect authent
CVE-2026-50089 MEDIUM
6.1 Jun 12

Open redirect in the Aqara IAM/SSO Gateway (gw-builder.aqara.com) allows remote unauthenticated attackers to craft Aqara
CVE-2026-10837 MEDIUM
5.1 Jun 17

Open redirection in Password Manager exposes users to phishing attacks by failing to validate the X-Forwarded-Host HTTP

CVE-2026-10839 MEDIUM
5.1 Jun 17

Open redirection in the Password Manager authentication system enables network-accessible, unauthenticated attackers to

Vendor StatusVendor

Ubuntu

Priority: Medium
firefox
Release Status Version
jammy not-affected code not present
noble not-affected code not present
oracular not-affected code not present
plucky not-affected code not present
upstream not-affected debian: Android-specific
questing not-affected code not present
thunderbird
Release Status Version
noble not-affected code not present
oracular not-affected code not present
plucky not-affected code not present
upstream needs-triage -
jammy not-affected code not present
questing not-affected code not present
mozjs38
Release Status Version
bionic needs-triage -
jammy DNE -
noble DNE -
oracular DNE -
plucky DNE -
upstream needs-triage -
questing DNE -
mozjs52
Release Status Version
bionic ignored -
focal ignored -
jammy DNE -
noble DNE -
oracular DNE -
plucky DNE -
upstream needs-triage -
questing DNE -
mozjs68
Release Status Version
focal ignored -
jammy DNE -
noble DNE -
oracular DNE -
plucky DNE -
upstream needs-triage -
questing DNE -
mozjs78
Release Status Version
jammy ignored -
noble DNE -
oracular DNE -
plucky DNE -
upstream needs-triage -
questing DNE -
mozjs91
Release Status Version
jammy ignored -
noble DNE -
oracular DNE -
plucky DNE -
upstream needs-triage -
questing DNE -
mozjs102
Release Status Version
jammy ignored -
noble ignored -
oracular DNE -
plucky DNE -
upstream needs-triage -
questing DNE -
mozjs115
Release Status Version
jammy DNE -
noble ignored -
oracular ignored -
plucky ignored -
upstream needs-triage -
questing DNE -

Debian

firefox
Release Status Fixed Version Urgency
sid fixed 148.0.2-1 -
(unstable) not-affected - -

SUSE

Severity: Medium
Product Status
Image SLES12-SP5-SAP-Azure-LI-BYOS-Production Image SLES12-SP5-SAP-Azure-VLI-BYOS-Production Affected
Image SLES15-SP4-SAP-Azure-LI-BYOS Image SLES15-SP4-SAP-Azure-LI-BYOS-Production Image SLES15-SP4-SAP-Azure-VLI-BYOS Image SLES15-SP4-SAP-Azure-VLI-BYOS-Production Affected
Image SLES15-SP5-SAP-Azure-LI-BYOS Image SLES15-SP5-SAP-Azure-LI-BYOS-Production Image SLES15-SP5-SAP-Azure-VLI-BYOS Image SLES15-SP5-SAP-Azure-VLI-BYOS-Production Affected
Image SLES15-SP6-SAP-Azure-LI-BYOS Image SLES15-SP6-SAP-Azure-LI-BYOS-Production Image SLES15-SP6-SAP-Azure-VLI-BYOS Image SLES15-SP6-SAP-Azure-VLI-BYOS-Production Image SLES15-SP7-SAP-Azure-LI-BYOS-Production Image SLES15-SP7-SAP-Azure-VLI-BYOS-Production Affected
SUSE Enterprise Storage 7.1 Fixed

Share

CVE-2025-6428 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy