Skip to main content

WebOb CVE-2026-54770

| EUVDEUVD-2026-63467 MEDIUM
URL Redirection to Untrusted Site (Open Redirect) (CWE-601)
2026-08-20 GitHub_M GHSA-6hx8-3wjj-gr8g
Open Redirect Webob
6.1
CVSS 3.1 · Vendor: GitHub_M
Share

Severity by source

Vendor (GitHub_M) PRIMARY
6.1 MEDIUM
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
vuln.today AI
6.1 MEDIUM

Network-exploitable with no authentication; user must follow the redirect (UI:R); scope changes to victim browser session; no availability impact.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N
SUSE
MEDIUM
qualitative

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Changed
Confidentiality
Low
Integrity
Low
Availability
None

Lifecycle Timeline

3
Source Code Evidence Fetched
Aug 20, 2026 - 17:55 vuln.today
Analysis Generated
Aug 20, 2026 - 17:55 vuln.today
Patch available
Aug 20, 2026 - 17:02 EUVD

Blast Radius

ecosystem impact
† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth
  • 1,942 pypi packages depend on webob (198 direct, 1,760 indirect)

Ecosystem-wide dependent count for version 1.8.11.

DescriptionCVE.org

WebOb provides objects for HTTP requests and responses. Prior to 1.8.11, Response._make_location_absolute() in src/webob/response.py checks a Location value for a URI scheme or leading double slash before urllib.parse.urljoin() strips leading C0 control characters and spaces. An attacker-controlled value such as a space followed by a protocol-relative or absolute URL can therefore bypass SCHEME_RE and startswith("//") checks and be normalized to an off-host redirect. Request.relative_url() and webob.exc._HTTPMove subclasses, including HTTPFound, are also affected because they use the same unsafe URL joining behavior or bypass the earlier normalization path. An unauthenticated attacker who can influence an application's redirect target can send users to an attacker-controlled host for phishing or OAuth and SSO token theft, but exploitation requires the user to follow the redirect. This issue is fixed in version 1.8.11.

AnalysisAI

Open redirect bypass in WebOb prior to 1.8.11 enables network-accessible, unauthenticated attackers to redirect users to attacker-controlled hosts by exploiting a URL normalization gap between WebOb's validation checks and Python's urllib.parse.urljoin. The flaw exists in Response._make_location_absolute(), Request.relative_url(), and _HTTPMove subclasses including HTTPFound - a space-prefixed protocol-relative or absolute URL passes SCHEME_RE and startswith('//') guards unchanged, then urllib.parse.urljoin silently strips the leading space on Python 3.10+, resolving the remainder as a valid off-host URL. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Recon
technique details hidden
Delivery
technique details hidden
Exploit
technique details hidden
Install
technique details hidden
C2
technique details hidden
Execute
technique details hidden
Impact
technique details hidden
Step 8
technique details hidden
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires all three of the following concrete conditions: (1) the application uses WebOb < 1.8.11 and exposes an endpoint - such as a login redirect, OAuth callback, or password reset flow - that accepts attacker-influenced redirect destination values and passes them to Response.location, HTTPFound, or Request.relative_url() without its own destination allowlist; (2) the attacker can inject a Location value prefixed with an ASCII space (0x20) or other C0 control character before a protocol-relative URL (e.g., ' //evil.example.com/') or absolute URL (e.g., ' https://evil.example.com/'), bypassing WebOb's pre-validation; (3) the victim user must actively follow the issued 302 redirect (UI:R). … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The vendor-assigned CVSS 6.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) accurately characterizes this as a medium-severity, network-exploitable flaw with no authentication barrier but a mandatory user-interaction prerequisite that precludes fully automated mass exploitation. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation Upgrade to WebOb 1.8.11, which replaces urllib.parse.urljoin with a custom RFC 3986-compliant webob.util.urljoin that performs no character stripping, closing the normalization bypass. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Open Redirect

View all
CVE-2017-1000117 HIGH POC
8.8 Oct 05

A malicious third-party can give a crafted "ssh://..." URL to an unsuspecting victim, and an attempt to visit the URL ca
CVE-2024-52875 HIGH POC
8.8 Jan 31

GFI Kerio Control versions 9.2.5 through 9.4.5 contain an HTTP response splitting vulnerability in the dest parameter of
CVE-2016-5385 HIGH POC
8.1 Jul 19

PHP through 7.0.8 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect
CVE-2013-2248 MEDIUM POC
5.8 Jul 20

Multiple open redirect vulnerabilities in Apache Struts 2.0.0 through 2.3.15 allow remote attackers to redirect users to
CVE-2012-6499 MEDIUM POC
5.8 Jan 12

Open redirect vulnerability in age-verification.php in the Age Verification plugin 0.4 and earlier for WordPress allows

CVE-2015-2863 MEDIUM POC
4.3 Jul 20

Open redirect vulnerability in Kaseya Virtual System Administrator (VSA) 7.x before 7.0.0.29, 8.x before 8.0.0.18, 9.0 b
CVE-2017-3528 MEDIUM POC
5.4 Apr 24

Vulnerability in the Oracle Applications Framework component of Oracle E-Business Suite (subcomponent: Popup windows (li
CVE-2012-0518 MEDIUM
4.7 Oct 16

Unspecified vulnerability in the Oracle Application Server Single Sign-On component in Oracle Fusion Middleware 10.1.4.3
CVE-2024-21641 MEDIUM POC
6.5 Jan 05

Flarum is open source discussion platform software. Rated medium severity (CVSS 6.5), this vulnerability is remotely exp
CVE-2015-5354 MEDIUM POC
5.8 Jul 01

Open redirect vulnerability in Novius OS 5.0.1 (Elche) allows remote attackers to redirect users to arbitrary web sites

CVE-2015-5461 MEDIUM POC
6.4 Jul 08

Open redirect vulnerability in the Redirect function in stageshow_redirect.php in the StageShow plugin before 5.0.9 for

CVE-2024-22891 CRITICAL POC
9.8 Mar 01

Nteract v.0.28.0 was discovered to contain a remote code execution (RCE) vulnerability via the Markdown link. Rated crit

Same weakness CWE-601 – URL Redirection to Untrusted Site (Open Redirect)

View all
CVE-2017-1000117 HIGH POC
8.8
CVE-2016-5385 HIGH POC
8.1
CVE-2017-3528 MEDIUM POC
5.4
CVE-2012-0518 MEDIUM
4.7
CVE-2024-21641 MEDIUM POC
6.5
CVE-2015-5354 MEDIUM POC
5.8
CVE-2024-22891 CRITICAL POC
9.8
CVE-2022-40083 CRITICAL POC
9.6

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Performance Computing 12 Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Affected
SUSE Linux Enterprise Module for Basesystem 15 SP7 Affected
SUSE Linux Enterprise Module for Package Hub 15 SP7 Affected

Share

CVE-2026-54770 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy