EUVD-2026-25877Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
OAuth endpoint is network-accessible with no authentication required, but user interaction is mandatory; no confidentiality or availability impact applies.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
5DescriptionCVE.org
An open redirect in the /api/google/authorize endpoint of hunvreus DevPush v0.3.2 allows attackers to redirect users to malicious sites via supplying a crafted URL.
AnalysisAI
Open redirect in DevPush v0.3.2's Google OAuth endpoint allows unauthenticated remote attackers to redirect victims to attacker-controlled sites by supplying a crafted URL to the /api/google/authorize endpoint. The attack requires user interaction (UI:R per CVSS), limiting practical exploitation to phishing scenarios where victims must click a malicious link. No active exploitation is identified (EPSS 0.01%, 1st percentile; SSVC exploitation: none), though a public disclosure gist exists suggesting exploit mechanics are documented.
Technical ContextAI
DevPush is a self-hosted deployment management tool by hunvreus that implements Google OAuth authentication via the /api/google/authorize endpoint. The vulnerability is classified as CWE-601 (URL Redirection to Untrusted Site / Open Redirect), a well-understood class of flaw common in OAuth callback flows where a redirect_uri or target parameter is accepted from user input without validation against a server-side allowlist. The CPE is listed as cpe:2.3:a:n/a:n/a:*:*:*:*:*:*:*:* in available intelligence, indicating the product is not formally catalogued in NVD. The affected endpoint sits within the authentication flow, making it a plausible vector for credential harvesting attacks when paired with social engineering.
RemediationAI
No vendor-released patch addressing this open redirect vulnerability has been identified at time of analysis. The v0.3.2 release notes explicitly confirm that this release addressed only automated backup functionality and Traefik configuration fixes - the open redirect was not remediated in this version. Monitor the GitHub repository at https://github.com/hunvreus/devpush for a subsequent patched release. As an immediate compensating control, restrict network access to the DevPush instance to trusted networks or VPN, preventing external attackers from crafting and distributing phishing URLs pointing to the /api/google/authorize endpoint. If Google OAuth is not required, disabling it removes the vulnerable endpoint entirely, though this impacts the authentication flow. Alternatively, configure the Traefik reverse proxy (already used by DevPush) to validate or strip redirect-related query parameters on requests to /api/google/authorize, preventing parameter manipulation without disabling the feature.
More in Open Redirect
View allA malicious third-party can give a crafted "ssh://..." URL to an unsuspecting victim, and an attempt to visit the URL ca
GFI Kerio Control versions 9.2.5 through 9.4.5 contain an HTTP response splitting vulnerability in the dest parameter of
PHP through 7.0.8 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect
Multiple open redirect vulnerabilities in Apache Struts 2.0.0 through 2.3.15 allow remote attackers to redirect users to
Open redirect vulnerability in age-verification.php in the Age Verification plugin 0.4 and earlier for WordPress allows
Open redirect vulnerability in Kaseya Virtual System Administrator (VSA) 7.x before 7.0.0.29, 8.x before 8.0.0.18, 9.0 b
Vulnerability in the Oracle Applications Framework component of Oracle E-Business Suite (subcomponent: Popup windows (li
Unspecified vulnerability in the Oracle Application Server Single Sign-On component in Oracle Fusion Middleware 10.1.4.3
Flarum is open source discussion platform software. Rated medium severity (CVSS 6.5), this vulnerability is remotely exp
Open redirect vulnerability in Novius OS 5.0.1 (Elche) allows remote attackers to redirect users to arbitrary web sites
Open redirect vulnerability in the Redirect function in stageshow_redirect.php in the StageShow plugin before 5.0.9 for
Nteract v.0.28.0 was discovered to contain a remote code execution (RCE) vulnerability via the Markdown link. Rated crit
Share
External POC / Exploit Code
Leaving vuln.today