Monthly
Open redirect in ash_typescript's TypeScript client code generator allows an attacker who controls a path-parameter value to cause a generated client to forward its request - including any credentials configured in TypedControllerConfig - to an attacker-controlled host. Affected are applications using ash_typescript 0.15.0 through 0.17.x that expose generated TypeScript clients where path parameters are user-influenced. No public exploit or CISA KEV listing is present, and the EPSS signal is correspondingly low given the niche footprint of the library.
Open redirect in Helix Ultimate (Joomla extension by joomshaper.com) versions prior to 2.2.10 allows unauthenticated network-accessible attackers to craft redirect URLs that bypass the site's origin validation. The return parameter accepts arbitrary Base64-encoded strings without invoking Joomla's Uri::isInternal() check, meaning the decoded destination is never validated as belonging to the host site. An attacker can exploit this to redirect victims to attacker-controlled external domains, enabling highly convincing phishing campaigns that abuse the trusted appearance of the legitimate site URL. No active exploitation has been identified at time of analysis.
Open redirect in Nokia NSP (Network Services Platform) enables remote unauthenticated attackers to craft URLs that bypass server-side validation of the redirect or URL parameter, redirecting authenticated users to attacker-controlled sites. Affected versions span NSP 23.11 through NSP 25.11 per EUVD data, covering a wide release window. No public exploit identified at time of analysis; EPSS of 0.14% at the 4th percentile reflects negligible observed exploitation activity, and the vulnerability is not listed in CISA KEV.
Open redirect in Rodauth before 2.47.0 enables post-authentication phishing by failing to reject protocol-relative return-to paths beginning with double slashes. The three affected features - confirm_password, login_return_to_requested_location, and two_factor_auth_return_to_requested_location - stored the raw request path into session without validating that it could not resolve as an external URL. No public exploit or active exploitation has been confirmed at time of analysis, and a patch is available in version 2.47.0.
Open redirect in pac4j-core before 6.5.6 allows network-accessible attackers to redirect authenticated users to attacker-controlled sites immediately after logout. DefaultLogoutLogic.perform() validated logout redirect targets against a URL pattern regex, but that regex did not exclude backslash characters; browsers normalize backslash-prefixed paths (e.g., \evil.com) into network-path references (//evil.com), bypassing the intended allow-list. No public exploit code has been identified and the vulnerability is not listed in CISA KEV, but the low attack complexity makes exploitation straightforward once a crafted logout link reaches a victim.
Open redirect in MasterStudy LMS WordPress Plugin before version 3.7.43 enables unauthenticated attackers to supply an unvalidated redirect parameter during user registration, silently forwarding newly registered users to arbitrary external URLs. This creates a reliable phishing vector: an attacker crafts a registration link pointing to a spoofed login page, and the plugin delivers the victim there immediately post-registration without warning. A publicly available proof-of-concept exists per WPScan, though the EPSS score of 0.14% (3rd percentile) indicates exploitation has not yet become widespread or automated.
Open redirect in Pocket ID's OIDC /authorize page (versions 2.6.0-2.8.0) allows an unauthenticated network attacker to redirect any victim browser to an arbitrary external HTTPS URL by supplying a crafted authorization link with prompt=none and an unregistered redirect_uri. The SvelteKit frontend's onMount() handler issues window.location.href from the raw redirect_uri before the backend's allow-list validator is ever invoked, completely bypassing the per-client callback URL enforcement that protects the standard interactive flow. A public PoC is confirmed at code level (commit fc42f62) and the fix is released in v2.9.0; no active exploitation (CISA KEV) has been reported.
OAuth authorization code forwarding to attacker-controlled hosts is enabled by an open redirect flaw in Twenty CRM through version 2.35.0, where the OAuthPropagatorController.propagateOAuthCallback endpoint accepts the state query parameter as an unvalidated redirect URL. Instances running with IS_MULTIWORKSPACE_ENABLED disabled are specifically vulnerable because this configuration bypasses the domain validation logic that would otherwise restrict redirect targets. No active exploitation has been confirmed in the CISA KEV catalog and no public proof-of-concept code was identified in the provided data, but the attack requires only a crafted link and passive victim interaction.
Open redirect in Spring Authorization Server 1.5.0-1.5.7 allows remote unauthenticated attackers to redirect victims to attacker-controlled sites by crafting authorization requests that pair an invalid request_uri with an unvalidated redirect_uri. The CVSS scope change (S:C) reflects that the redirect escapes the authorization server's security boundary, enabling high-trust phishing attacks because victims see the legitimate authorization server domain before being redirected. No public exploit has been identified at time of analysis, and exploitation requires user interaction.
Open redirect in Spring Framework's UrlFileNameViewController exposes users of affected Spring MVC applications to phishing and credential-harvesting attacks across all active Spring Framework release trains (5.2.x through 7.0.x). The flaw allows an unauthenticated attacker to craft a URL that causes the vulnerable application to redirect victims to an arbitrary external domain, exploiting the controller's path-to-view-name resolution when end-of-path mapping is used without a configured prefix. No active exploitation has been confirmed - EPSS sits at 0.14% (4th percentile) and CISA SSVC reports exploitation status as none, making this a targeted patching priority rather than an emergency.
Open redirect in ash_typescript's TypeScript client code generator allows an attacker who controls a path-parameter value to cause a generated client to forward its request - including any credentials configured in TypedControllerConfig - to an attacker-controlled host. Affected are applications using ash_typescript 0.15.0 through 0.17.x that expose generated TypeScript clients where path parameters are user-influenced. No public exploit or CISA KEV listing is present, and the EPSS signal is correspondingly low given the niche footprint of the library.
Open redirect in Helix Ultimate (Joomla extension by joomshaper.com) versions prior to 2.2.10 allows unauthenticated network-accessible attackers to craft redirect URLs that bypass the site's origin validation. The return parameter accepts arbitrary Base64-encoded strings without invoking Joomla's Uri::isInternal() check, meaning the decoded destination is never validated as belonging to the host site. An attacker can exploit this to redirect victims to attacker-controlled external domains, enabling highly convincing phishing campaigns that abuse the trusted appearance of the legitimate site URL. No active exploitation has been identified at time of analysis.
Open redirect in Nokia NSP (Network Services Platform) enables remote unauthenticated attackers to craft URLs that bypass server-side validation of the redirect or URL parameter, redirecting authenticated users to attacker-controlled sites. Affected versions span NSP 23.11 through NSP 25.11 per EUVD data, covering a wide release window. No public exploit identified at time of analysis; EPSS of 0.14% at the 4th percentile reflects negligible observed exploitation activity, and the vulnerability is not listed in CISA KEV.
Open redirect in Rodauth before 2.47.0 enables post-authentication phishing by failing to reject protocol-relative return-to paths beginning with double slashes. The three affected features - confirm_password, login_return_to_requested_location, and two_factor_auth_return_to_requested_location - stored the raw request path into session without validating that it could not resolve as an external URL. No public exploit or active exploitation has been confirmed at time of analysis, and a patch is available in version 2.47.0.
Open redirect in pac4j-core before 6.5.6 allows network-accessible attackers to redirect authenticated users to attacker-controlled sites immediately after logout. DefaultLogoutLogic.perform() validated logout redirect targets against a URL pattern regex, but that regex did not exclude backslash characters; browsers normalize backslash-prefixed paths (e.g., \evil.com) into network-path references (//evil.com), bypassing the intended allow-list. No public exploit code has been identified and the vulnerability is not listed in CISA KEV, but the low attack complexity makes exploitation straightforward once a crafted logout link reaches a victim.
Open redirect in MasterStudy LMS WordPress Plugin before version 3.7.43 enables unauthenticated attackers to supply an unvalidated redirect parameter during user registration, silently forwarding newly registered users to arbitrary external URLs. This creates a reliable phishing vector: an attacker crafts a registration link pointing to a spoofed login page, and the plugin delivers the victim there immediately post-registration without warning. A publicly available proof-of-concept exists per WPScan, though the EPSS score of 0.14% (3rd percentile) indicates exploitation has not yet become widespread or automated.
Open redirect in Pocket ID's OIDC /authorize page (versions 2.6.0-2.8.0) allows an unauthenticated network attacker to redirect any victim browser to an arbitrary external HTTPS URL by supplying a crafted authorization link with prompt=none and an unregistered redirect_uri. The SvelteKit frontend's onMount() handler issues window.location.href from the raw redirect_uri before the backend's allow-list validator is ever invoked, completely bypassing the per-client callback URL enforcement that protects the standard interactive flow. A public PoC is confirmed at code level (commit fc42f62) and the fix is released in v2.9.0; no active exploitation (CISA KEV) has been reported.
OAuth authorization code forwarding to attacker-controlled hosts is enabled by an open redirect flaw in Twenty CRM through version 2.35.0, where the OAuthPropagatorController.propagateOAuthCallback endpoint accepts the state query parameter as an unvalidated redirect URL. Instances running with IS_MULTIWORKSPACE_ENABLED disabled are specifically vulnerable because this configuration bypasses the domain validation logic that would otherwise restrict redirect targets. No active exploitation has been confirmed in the CISA KEV catalog and no public proof-of-concept code was identified in the provided data, but the attack requires only a crafted link and passive victim interaction.
Open redirect in Spring Authorization Server 1.5.0-1.5.7 allows remote unauthenticated attackers to redirect victims to attacker-controlled sites by crafting authorization requests that pair an invalid request_uri with an unvalidated redirect_uri. The CVSS scope change (S:C) reflects that the redirect escapes the authorization server's security boundary, enabling high-trust phishing attacks because victims see the legitimate authorization server domain before being redirected. No public exploit has been identified at time of analysis, and exploitation requires user interaction.
Open redirect in Spring Framework's UrlFileNameViewController exposes users of affected Spring MVC applications to phishing and credential-harvesting attacks across all active Spring Framework release trains (5.2.x through 7.0.x). The flaw allows an unauthenticated attacker to craft a URL that causes the vulnerable application to redirect victims to an arbitrary external domain, exploiting the controller's path-to-view-name resolution when end-of-path mapping is used without a configured prefix. No active exploitation has been confirmed - EPSS sits at 0.14% (4th percentile) and CISA SSVC reports exploitation status as none, making this a targeted patching priority rather than an emergency.