By weakness (CWE)

CWE-601: related vulnerabilities

CVEs classified under CWE-601. Understanding the weakness class helps prioritize systemic fixes over one-off patches.

48 published vulnerabilities

• CVE-2026-35259HIGH 8.8

  A vulnerability in Oracle WebLogic Server's Console component allows an attacker on the network to trick a user into clicking a malicious link or visiting a compromised page, ultimately gaining complete control over the WebLogic Server. The attacker doesn't need any special access—they can reach the vulnerable system over the internet via HTTPS. However, the attack requires the target user to interact with the attacker's content, such as clicking a phishing link. Affected versions are 14.1.2.0.0 and 15.1.1.0.0. The impact is severe: unauthorized access, data theft, system manipulation, and service disruption.

• CVE-2026-47645HIGH 8.8

  CVE-2026-47645 is a critical flaw in Microsoft 365 Copilot's Business Chat feature that allows attackers to trick users into visiting malicious websites by crafting deceptive links. When exploited, this open redirect vulnerability can enable an attacker to escalate their privileges within the targeted organization. The attack requires user interaction—specifically, a victim must click a malicious link—but no special access or complex conditions are needed to craft the exploit, making it a significant risk for organizations relying on Copilot for business communications.

• CVE-2026-55237HIGH 8.8

  AutoGPT versions before 0.6.62 contain a DOM-based cross-site scripting (XSS) vulnerability in the signup page. An attacker can craft a malicious link that tricks an authenticated user into clicking it, then executes arbitrary JavaScript in the victim's browser. This happens because the application unsafely uses a URL parameter called `next` to redirect users without properly validating it. Once the attacker's code runs, they could steal login credentials, access internal systems, or perform actions as if they were the victim.

• CVE-2026-35258HIGH 8.7

  Oracle WebLogic Server contains a vulnerability in its Console component that allows an attacker with low-level network access to manipulate critical data or gain unauthorized access to sensitive information. The attack requires some form of user interaction—such as an administrator clicking a malicious link—but once successful, the attacker can read or modify data across the WebLogic environment and potentially affect connected systems. The vulnerability affects versions 14.1.2.0.0 and 15.1.1.0.0.

• CVE-2026-35302HIGH 8.3

  Oracle WebLogic Server contains a vulnerability in its administrative console that allows an unauthenticated attacker to potentially take over the server. The attack requires network access and relies on tricking a user into taking action, but once successful, an attacker gains complete control—including the ability to read sensitive data, modify systems, and disrupt operations. Two widely-deployed versions (12.2.1.4.0 and 14.1.1.0.0) are affected. While the flaw lives in WebLogic itself, compromising it can cascade to impact other Oracle Fusion Middleware products running in the same environment.

• CVE-2026-46806HIGH 8.2

  A flaw in Oracle WebCenter Content version 14.1.2.0.0 allows unauthenticated attackers to gain unauthorized access to sensitive data or modify content through the network. The vulnerability exploits trust in HTTPS connections and relies on tricking a user into clicking a malicious link or visiting a crafted page. While the vulnerability exists in WebCenter Content, successful exploitation can affect other connected Oracle systems. The attacker does not need valid credentials, but the attack requires user interaction—typically clicking a link sent via email or social engineering.

• CVE-2026-46796HIGH 8.0

  A vulnerability in Oracle WebCenter Sites allows a low-privileged attacker with network access to take over the system through a specially crafted request. The attack requires tricking an authorized user into clicking a malicious link or interacting with the attacker's content. While the attacker needs existing low-level access and user interaction to succeed, successful exploitation results in complete compromise of the WebCenter Sites instance, including exposure of sensitive data and ability to modify or disable systems.

• CVE-2026-46894HIGH 8.0

  A vulnerability in Oracle's iSupplier Portal—a supplier management component of Oracle E-Business Suite—allows a low-privileged attacker to gain complete control over the portal through a specially crafted request. The flaw requires tricking a legitimate user into interacting with malicious content, but once successful, an attacker can read sensitive data, modify information, or disrupt service availability. Versions 12.2.3 through 12.2.15 are affected.

• CVE-2026-46955HIGH 7.5

  A vulnerability in Oracle's Human Resources module within E-Business Suite allows an unauthenticated attacker to potentially take over the system. The attacker would need network access and would require the victim to interact with a malicious link or content—making it a social engineering vector rather than a direct attack. While exploitation is difficult to execute, successful compromise could give an attacker full control over HR data and functions.

• CVE-2026-40961HIGH 7.2

  Apache Airflow contains a flaw in its login redirect mechanism that allows authenticated users to redirect people to malicious websites. The vulnerability exists because the URL safety check (`is_safe_url`) can be circumvented through crafted URLs, enabling attackers to potentially harvest credentials or distribute malware by making the redirect appear to come from a trusted Airflow instance. Any organization running Airflow and allowing authentication should treat this as a priority.

• CVE-2026-48895HIGH 7.2

  Apache APISIX versions 3.0.0 through 3.16.0 contain an open-redirect vulnerability that allows attackers to manipulate HTTP client headers and redirect users to untrusted websites. This attack could potentially expose session tokens or other sensitive authentication data. The issue affects the API gateway's request handling and requires upgrading to version 3.17.0 or later to remediate.

• CVE-2026-53523MEDIUM 6.8

  Nezha Monitoring, a self-hosted server and website monitoring tool, contains a host header injection vulnerability in its OAuth2 authentication flow. Attackers can manipulate the Host header in requests to trick the application into constructing malicious OAuth2 callback URLs, potentially redirecting users to attacker-controlled sites during the authentication process. The vulnerability affects all versions from 1.0.0 through 2.1.x and has been fixed in version 2.2.0.

• CVE-2026-48856MEDIUM 6.5

  Erlang's httpc HTTP client has a credential-leakage flaw in how it handles HTTP redirects. When a server sends a redirect response (3xx status), httpc automatically follows it to the new location while preserving the original Authorization and Proxy-Authorization headers—including any embedded credentials. An attacker controlling both the initial target server and the redirect destination can trick the client into sending credentials to an attacker-controlled domain. Since automatic redirects are enabled by default, this affects most applications using httpc unless they explicitly disable the feature.

• CVE-2026-10856MEDIUM 6.1

  MISP dashboard widgets contain a URL validation flaw that allows attackers to craft malicious buttons appearing to link within the application while actually redirecting users to external sites. The vulnerability stems from incomplete validation that accepts paths like '/\example.com', which browsers may normalize into scheme-relative URLs pointing to attacker-controlled domains. An attacker with dashboard configuration access can embed these crafted buttons to redirect legitimate users, creating phishing and credential-theft opportunities.

• CVE-2026-10861MEDIUM 6.1

  MISP, a widely-used threat intelligence sharing platform, contains an open redirect vulnerability in its post-login redirect logic. When a user logs in, the application redirects them to a URL stored in the session without properly validating that the destination is actually part of the MISP application. An attacker can craft a malicious link that tricks users into visiting their legitimate MISP instance, then redirects them to an attacker-controlled website after they authenticate. This could be weaponized for phishing by appearing to come from a trusted source or to deliver malware from a domain the victim might not otherwise visit.

• CVE-2026-21826MEDIUM 6.1

  HCL Digital Experience and HCL Digital Experience Compose contain a host header injection vulnerability that allows an attacker to manipulate how the application processes the Host header in HTTP requests. By injecting a malicious Host value, an attacker can trigger unexpected application behavior, potentially leading to phishing attacks, cache poisoning, or credential theft. The vulnerability requires user interaction—such as clicking a malicious link—to be exploited, which moderates the overall risk profile.

• CVE-2026-40181MEDIUM 6.1

  React Router, a widely-used navigation library for React applications, contains an open redirect vulnerability in specific versions. When certain URLs are passed to the redirect function, the library can inadvertently send users to an external website controlled by an attacker. This happens because paths beginning with double slashes (//) are misinterpreted as protocol-relative URLs, allowing an attacker to craft a malicious URL that bypasses the intended redirect destination. The vulnerability only affects applications using the programmatic redirect function; applications built with React Router's declarative mode (using <BrowserRouter>) are not impacted. The severity of the risk depends on how thoroughly the application validates URLs before redirecting.

• CVE-2026-41008MEDIUM 6.1

  Spring Security Authorization Server contains an open redirect vulnerability in its authorization endpoint. When processing OAuth 2.0 authorization requests, the server insufficiently validates the request_uri parameter, allowing an attacker to combine an invalid request_uri with a crafted redirect_uri to redirect users to an attacker-controlled website after authentication. This affects Spring Security versions 7.0.0–7.0.5 and Spring Authorization Server versions 1.5.0–1.5.7.

• CVE-2026-41569MEDIUM 6.1

  authentik, an open-source identity provider, contains a URL validation flaw in its WS-Federation provider that allows attackers to redirect users' login credentials to attacker-controlled domains. The vulnerability stems from incomplete validation of the wreply parameter—a redirect URL used after authentication. An attacker can craft a malicious login link where the wreply parameter points to a lookalike domain (for example, https://portal.example.com.evil.tld/) that bypasses the validation check, tricking users into sending their signed authentication response to the attacker instead of the legitimate application. This affects authentik versions prior to 2026.2.3.

• CVE-2026-41706MEDIUM 6.1

  Spring Security's request caching mechanisms (CookieRequestCache and CookieServerRequestCache) contain an open redirect vulnerability. These components store the URL users intended to visit before logging in, then redirect them there after successful authentication. The vulnerability exists because the stored URL is not validated before being used as a redirect target, allowing attackers to craft malicious login links that redirect authenticated users to arbitrary external websites. An attacker could exploit this to perform phishing attacks, credential harvesting, or malware distribution by tricking users into clicking a specially crafted link.

• CVE-2026-44889MEDIUM 6.1

  WebOb, a widely-used Python library for HTTP request and response handling, contains an open redirect vulnerability in how it processes redirect locations. An attacker can craft a malicious redirect URL containing whitespace characters (tabs, carriage returns, newlines) that bypass existing protections, causing users to be sent to an attacker-controlled website instead of the legitimate destination. The vulnerability affects versions before 1.8.10 and relies on the user clicking a link or visiting a page that triggers the vulnerable redirect.

• CVE-2026-44915MEDIUM 6.1

  Apache APISIX contains an open redirect vulnerability in its default CAS authentication configuration. An attacker can craft a malicious link that redirects users to an untrusted website after they authenticate, enabling phishing and credential theft. The vulnerability affects APISIX versions 3.0.0 through 3.16.0, and organizations should upgrade to version 3.17.0 to remediate the issue.

• CVE-2026-45307MEDIUM 6.1

  Speakr, a self-hosted audio transcription web application, contains an open redirect vulnerability in its post-login redirect logic. An attacker can craft a malicious URL that passes the application's safety validation but redirects authenticated users to an external attacker-controlled website. The flaw stems from a mismatch between how the validation function and the redirect function interpret scheme-relative URLs (those beginning with ////). The vulnerability affects versions prior to 0.8.20-alpha and is user-interaction dependent—victims must click a malicious link after logging in.

• CVE-2026-45566MEDIUM 6.1

  Roxy-WI, a web management interface for load balancers and web servers, contains a login redirect flaw that allows attackers to bypass security checks and trick users into visiting attacker-controlled websites. The vulnerability exploits an incomplete validation rule that rejects redirect URLs containing 'https://' or 'http://', but fails to account for the userinfo syntax (user@host format). By crafting a specially formed next parameter, an attacker can inject their domain into the redirect URL in a way that modern browsers interpret as routing to the attacker's site rather than the legitimate one. Successful exploitation requires user interaction—specifically a click on a malicious link—but carries real risk for credential harvesting and session hijacking.

• CVE-2026-50089MEDIUM 6.1

  Aqara's IAM/SSO Gateway (gw-builder.aqara.com) contains an open redirect flaw that allows attackers to craft malicious links appearing to direct users to the legitimate Aqara domain, but actually redirecting them to attacker-controlled sites. This is a classic phishing vector: a user trusts the initial Aqara URL, clicks it, and lands on a fraudulent login page or malware distribution point. The vulnerability requires user interaction (a click) and affects the confidentiality and integrity of user sessions, making it a medium-severity network-based threat.

• CVE-2026-54276MEDIUM 6.1

  AIOHTTP, a widely-used Python framework for building asynchronous HTTP applications, contains a flaw in its DigestAuthMiddleware component that can leak user credentials across domain boundaries. When a server redirects an authenticated user to a different domain (via an open redirect or similar vulnerability), AIOHTTP may automatically resend the digest authentication response to the attacker-controlled destination. An attacker cannot directly extract plaintext passwords from the digest alone, but the digest itself becomes a credential an attacker can attempt to crack or replay if cryptography is weak or if users reuse passwords across services.

• CVE-2026-56326MEDIUM 6.1

  Nuxt, a popular JavaScript framework for building web applications, contains a vulnerability in its `navigateTo` function that can be tricked into redirecting users to attacker-controlled websites. The vulnerability affects Nuxt 4.0.0 through 4.4.6 and all 3.x versions before 3.21.7. Attackers exploit this by crafting specially formatted URLs that bypass the framework's validation of external redirect targets, allowing them to send victims to phishing sites or steal authentication tokens. The attack requires user interaction—a victim must click a malicious link—but is otherwise straightforward to execute.

• CVE-2026-56697MEDIUM 6.1

  Nuxt, a popular web framework, has a vulnerability in its `reloadNuxtApp` function that allows attackers to trick users into visiting malicious websites. The flaw stems from how the function validates URLs—it checks whether a path starts with a script protocol (like `javascript:`), but protocol-relative URLs (those beginning with `//`) slip through this check. When a user-supplied path like `//evil.com` is processed, the browser resolves it using the current page's protocol (http or https), redirecting to the attacker's domain instead. This enables phishing attacks or theft of sensitive authorization codes from OAuth flows. Affected versions are Nuxt 4.0.0 through 4.4.6 and all 3.x versions before 3.21.7.

• CVE-2026-12622MEDIUM 5.4

  GridTime 3000 GNSS Time Servers contain an open redirect flaw in their password change functionality. When an authenticated user submits a password change request, the application can be tricked into redirecting them to an attacker-controlled website. An attacker would need valid credentials or the ability to socially engineer a legitimate user into clicking a malicious link that contains the redirect target. While the attacker cannot directly steal data or crash the system through this flaw, they can use it to harvest credentials, distribute malware, or conduct phishing attacks by making the redirect destination appear trustworthy.

• CVE-2026-41479MEDIUM 5.4

  Authlib, a popular Python library for building OAuth and OpenID Connect servers, contains an open redirect vulnerability in its authorization endpoint. When an attacker sends a specially crafted request with an unsupported response type and a malicious redirect URL, the server redirects users to that attacker-controlled site without proper validation. This happens before the system even checks if the client is legitimate or if the user is logged in, meaning an attacker needs no prior setup—just a single request can redirect an unsuspecting user elsewhere. The flaw affects versions before 1.6.10 and 1.7.1.

• CVE-2026-46616MEDIUM 5.4

  Umbraco CMS contains an open-redirect vulnerability in member-related Surface Controllers that fail to properly validate redirect URLs. When a Razor template uses user-controlled query parameters to set a redirect destination, an attacker can craft a malicious link that redirects users to an external site after they interact with the application. This undermines user trust and can be leveraged in phishing campaigns. Versions 13.14.0 and 17.4.0 and later address this issue.

• CVE-2026-52802MEDIUM 5.4

  Gogs, a self-hosted Git service, contains an open redirect vulnerability that allows attackers to trick users into visiting arbitrary external websites. The vulnerability exists because Gogs' validation function checks only the first two characters of a URL, missing a technique where directory traversal sequences followed by backslashes can bypass the security check. An attacker would need to social-engineer a user into clicking a malicious link, but once clicked, the user is silently redirected off the Gogs platform. This issue is resolved in version 0.14.3 and later.

• CVE-2026-28301MEDIUM 4.8

  CVE-2026-28301 is a URL redirection vulnerability that allows an attacker to craft a malicious link which, when followed by an authorized user, redirects them to an attacker-controlled website. The vulnerability requires an attacker to be on the same network segment as the target and needs a user with some level of system access to click the malicious link, but does not require the victim's interaction with a confirmation dialog. The attack results in confidentiality exposure rather than data modification or system unavailability.

• CVE-2026-56332MEDIUM 4.7

  Capgo before version 12.128.2 contains a flaw that allows attackers to redirect users to malicious websites during the signup confirmation process. An attacker can craft a deceptive confirmation link that appears legitimate but directs victims to an attacker-controlled site, where they might be tricked into entering credentials or downloading malware. The vulnerability requires user interaction—victims must click the malicious link—but poses a real phishing risk, especially if distributed through email or messaging channels.

• CVE-2025-32748MEDIUM 4.3

  Dell PowerFlex Manager versions before 5.1.0.1 contain a host header injection flaw that allows unauthenticated attackers with network access to craft malicious requests. By manipulating the HTTP Host header, an attacker can cause the application to redirect users to arbitrary external websites, potentially in service of phishing or social engineering campaigns. No authentication is required to trigger the vulnerability, but successful exploitation requires user interaction—the victim must follow the malicious redirect.

• CVE-2026-11477MEDIUM 4.3

  CVE-2026-11477 is an open redirect vulnerability in the OAuth2 Client component of hsweb-framework versions up to 5.0.1. An attacker can craft a malicious URL that tricks users into being redirected to an external website after authenticating through your application's OAuth2 flow. This could be used for phishing or credential harvesting attacks. The vulnerability requires user interaction (clicking a link) but can be exploited over the network without authentication. Public exploit code is already available.

• CVE-2026-12049MEDIUM 4.3

  pgAdmin 4 contains an open redirect flaw in its multi-factor authentication (MFA) flow. When a user completes MFA validation or registration, the application accepts a 'next' parameter—meant to redirect users back to their intended destination—without verifying that the target is actually part of pgAdmin. An attacker can craft a malicious link that redirects an authenticated user to an external website after they complete MFA, making the redirect appear to originate from the trusted pgAdmin domain. This is primarily a phishing amplification risk: the attacker doesn't gain access to pgAdmin or databases, but leverages pgAdmin's legitimate domain to increase the credibility of follow-on credential theft attempts.

• CVE-2026-12804MEDIUM 4.3

  CVE-2026-12804 is an open redirect vulnerability in lemonldap-ng, an open-source authentication and authorization platform, affecting versions up to 2.23.0. An attacker can manipulate a URL parameter in the SAML Common Domain Cookie (CDC) endpoint to redirect users to arbitrary external websites. This occurs when a user clicks a malicious link—the vulnerability requires user interaction and does not grant the attacker direct access to systems. The vendor has confirmed a fix is available in version 2.23.1.

• CVE-2026-20178MEDIUM 4.3

  A vulnerability in Cisco's browser-based Webex App could allow attackers to trick users into visiting malicious websites. The flaw involves inadequate validation of URL parameters, meaning a crafted link sent to a user could redirect them elsewhere if clicked. Cisco has already patched the issue, and users do not need to take action—the fix is applied server-side or through automatic updates.

• CVE-2026-47991MEDIUM 4.3

  Adobe Experience Manager contains a flaw that allows attackers to craft deceptive URLs that redirect users to attacker-controlled websites. If a victim clicks such a link, they may be taken to a fake login page or other malicious site where their credentials could be stolen, leading to account compromise. This vulnerability affects multiple AEM versions and requires user interaction—the attacker must convince someone to click the malicious link.

• CVE-2026-53436MEDIUM 4.3

  Jenkins contains a validation flaw in its login redirect mechanism that allows attackers to craft phishing URLs appearing to come from a legitimate Jenkins instance. When users log in, Jenkins is supposed to redirect them to internal pages, but the vulnerability allows attackers to redirect users to external malicious sites by exploiting how the application handles relative path segments (like `./` or `../`). An attacker would need to trick a user into clicking a specially crafted link, but the exploit itself is straightforward and doesn't require special technical skills.

• CVE-2026-53437MEDIUM 4.3

  Jenkins versions 2.567 and earlier (LTS 2.555.2 and earlier) contain a flaw in how they validate redirect URLs after user login. An attacker can craft a malicious redirect URL that appears to point to a legitimate Jenkins instance by inserting tab or newline characters between the `//` protocol separator, causing the validation to pass. When a user clicks such a link after logging in, they may be redirected to an attacker-controlled site while believing they're staying within Jenkins, enabling credential harvesting or other phishing attacks.

• CVE-2026-53440MEDIUM 4.3

  Jenkins versions 2.567 and earlier (LTS 2.555.2 and earlier) contain a flaw in their "Delegate to servlet container" security realm that fails to validate redirect destinations after user login. An attacker can craft a malicious link that redirects authenticated users to an attacker-controlled website, enabling phishing attacks that steal credentials or distribute malware while appearing to come from a legitimate Jenkins instance.

• CVE-2026-41844MEDIUM 4.2

  CVE-2026-41844 is a redirect vulnerability in Spring Framework that allows attackers to craft malicious links causing users' browsers to redirect to arbitrary external websites. The flaw exists in Spring MVC and Spring WebFlux applications configured with a catch-all URL mapping ("/**") where the view name is not explicitly set. An attacker can exploit the 'redirect:' prefix to bypass intended routing controls and send users to phishing sites or other malicious hosts. This requires user interaction—the victim must click a crafted link—and impacts four widely-used versions of Spring Framework spanning multiple release series.

• CVE-2026-56330LOW 3.5

  Capgo versions before 12.128.2 contain a flaw that allows authenticated users to manipulate billing-related URLs in ways that could redirect legitimate users to attacker-controlled websites. An attacker would need valid Capgo credentials and user interaction (a click on a malicious link) to exploit this. The vulnerability is rated LOW severity because it requires authentication and user action, though the phishing risk warrants attention in environments where billing workflows are exposed to untrusted users.

• CVE-2026-45278LOW 3.3

  Nextcloud's user OIDC (OpenID Connect) module contains an open redirect vulnerability that allows attackers to craft malicious login links. When users click these links to authenticate via OIDC, they are redirected to attacker-controlled websites after logging in. This affects Nextcloud versions 6.1.0 through 8.2.1. The vulnerability has a low CVSS score because it requires user interaction and does not directly compromise confidentiality or availability.

• CVE-2026-11502LOW 3.1

  JeecgBoot versions up to 3.9.2 contain an open redirect vulnerability in the third-party login flow. When users are directed to log in via OAuth providers like DingTalk or WeChat, an attacker can manipulate the state parameter to redirect victims to a malicious website after authentication. The attack requires social engineering—tricking a user into clicking a specially crafted login link—and only affects deployments that have enabled third-party login functionality.

• CVE-2026-49380LOW 3.1

  JetBrains TeamCity versions before 2026.1 contain an open redirect vulnerability in the SAML authentication plugin. An attacker could craft a malicious link that, when clicked by a user, redirects them to an attacker-controlled website after authentication. This requires user interaction and offers limited direct impact, but could be chained with phishing or credential harvesting tactics.