Open Redirect
CVE-2026-40255
MEDIUM
GHSA-6qvv-pj99-48qm
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Primary rating from GitHub Advisory · only source for this CVE.
CVSS VectorGitHub Advisory
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Lifecycle Timeline
4DescriptionGitHub Advisory
Impact
The response.redirect().back() method in @adonisjs/http-server is vulnerable to open redirects. The method reads the Referer header from the incoming HTTP request and redirects to that URL without validating the host. An attacker who can influence the Referer header (for example, by linking a user through an attacker-controlled page before a form submission) can cause the application to redirect users to a malicious external site.
This affects all AdonisJS applications that use response.redirect().back() or response.redirect('back').
The vulnerability is classified as CWE-601: URL Redirection to Untrusted Site ('Open Redirect').
Patches
This has been fixed in @adonisjs/http-server version 8.2.0. The back() method now validates the Referer header's host against the request's own Host header. Referrers from unrecognized hosts are rejected and the redirect falls back to / (or a developer-provided fallback URL).
Applications that operate across multiple domains can configure additional trusted hosts via the redirect.allowedHosts option in config/app.ts.
Users should upgrade to @adonisjs/http-server@^8.2.0 (or @adonisjs/core@^7.4.0 if using the core meta-package).
Workarounds
If upgrading is not immediately possible, avoid using response.redirect().back() in routes that are reachable by unauthenticated users or from pages that accept external traffic. Instead, redirect to a known safe path explicitly using response.redirect().toPath('/dashboard').
References
AnalysisAI
Open redirect vulnerability in AdonisJS @adonisjs/http-server allows unauthenticated remote attackers to redirect users to arbitrary external sites by manipulating the Referer HTTP header via the response.redirect().back() method. The vulnerability affects all AdonisJS applications using the back() redirect functionality and has been patched in version 8.2.0, which implements host validation against the incoming request's Host header. User interaction (clicking a malicious link) is required for exploitation, and no public exploit code or active exploitation has been identified.
Technical ContextAI
The vulnerability stems from improper input validation in the response.redirect().back() method within @adonisjs/http-server, a core HTTP handling library for the AdonisJS framework. The method blindly trusts the Referer HTTP header-a user-controlled input that indicates the previous page a user came from-and redirects to that URL without validating that the hostname matches the current application's legitimate domain. This is a classic open redirect vulnerability (CWE-601) where an attacker can craft a request with a malicious Referer header pointing to an attacker-controlled domain, causing victims to be redirected to phishing sites or malware distribution endpoints. The fix introduced in version 8.2.0 implements host validation by comparing the Referer header's host against the current request's Host header, rejecting mismatches and defaulting to a safe fallback path (/). Multi-domain applications can whitelist additional trusted hosts via the redirect.allowedHosts configuration option.
RemediationAI
Upgrade @adonisjs/http-server to version 8.2.0 or later (@adonisjs/http-server@^8.2.0), or upgrade @adonisjs/core to version 7.4.0 or later (@adonisjs/core@^7.4.0) if using the core meta-package. The patched version implements automatic host validation in the back() method and supports multi-domain configurations via the redirect.allowedHosts option in config/app.ts. If immediate upgrade is not feasible, apply a workaround by replacing all instances of response.redirect().back() with explicit safe redirects using response.redirect().toPath('/dashboard') or equivalent known-safe paths, particularly in routes accessible to unauthenticated users or pages accepting external traffic. Patch details and release notes are available at https://github.com/adonisjs/http-server/releases/tag/v8.2.0 and commit https://github.com/adonisjs/http-server/commit/2008fb6cf4f6f1c0ca5797d57def4d93e1c3de08.
More in Open Redirect
View allA malicious third-party can give a crafted "ssh://..." URL to an unsuspecting victim, and an attempt to visit the URL ca
GFI Kerio Control versions 9.2.5 through 9.4.5 contain an HTTP response splitting vulnerability in the dest parameter of
PHP through 7.0.8 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect
Multiple open redirect vulnerabilities in Apache Struts 2.0.0 through 2.3.15 allow remote attackers to redirect users to
Open redirect vulnerability in age-verification.php in the Age Verification plugin 0.4 and earlier for WordPress allows
Open redirect vulnerability in Kaseya Virtual System Administrator (VSA) 7.x before 7.0.0.29, 8.x before 8.0.0.18, 9.0 b
Vulnerability in the Oracle Applications Framework component of Oracle E-Business Suite (subcomponent: Popup windows (li
Unspecified vulnerability in the Oracle Application Server Single Sign-On component in Oracle Fusion Middleware 10.1.4.3
Flarum is open source discussion platform software. Rated medium severity (CVSS 6.5), this vulnerability is remotely exp
Open redirect vulnerability in Novius OS 5.0.1 (Elche) allows remote attackers to redirect users to arbitrary web sites
Open redirect vulnerability in the Redirect function in stageshow_redirect.php in the StageShow plugin before 5.0.9 for
Nteract v.0.28.0 was discovered to contain a remote code execution (RCE) vulnerability via the Markdown link. Rated crit
Share
External POC / Exploit Code
Leaving vuln.today