CVE-2026-44889: WebOb Open Redirect Vulnerability via Whitespace Bypass

Technical summary

The vulnerability exists in WebOb's HTTP Location header normalization during redirects. When constructing redirect URLs, WebOb uses Python's urljoin to join the redirect target with the request URI. Since Python 3.10, urlsplit strips ASCII whitespace characters (0x09, 0x0D, 0x0A) before parsing the URL. An attacker can embed these characters in a redirect target to create a URL that, after stripping, becomes a protocol-relative URL (beginning with //) pointing to an attacker's host. This circumvents the CVE-2024-42353 mitigation, which only escaped leading double slashes in the redirect location string. The resulting URL is then interpreted as pointing to an external authority under attacker control.

Business impact

Organizations relying on WebOb for HTTP request/response handling face risk of user credential theft and session hijacking. Attackers can redirect authenticated users away from legitimate applications to phishing sites or malware distribution endpoints. The attack requires user interaction (clicking a malicious link or visiting a compromised page) but is likely to succeed once triggered. For applications exposed to untrusted input in redirect parameters, the exposure is significant even at CVSS 6.1 Medium severity, as it directly enables account takeover scenarios.

Affected systems

The vulnerability affects WebOb versions prior to 1.8.10. WebOb is a dependency in Pylons, Pyramid, and other Python web frameworks. Any application using WebOb to construct or validate redirect responses is potentially affected. Systems running Python 3.10 or later are specifically vulnerable because earlier Python versions do not strip the whitespace characters that enable the bypass.

Exploitability

Exploitation requires an attacker to control or influence the redirect target URL—either through URL parameters, HTTP headers, or response body content in an application that constructs redirects dynamically. The attacker then embeds whitespace characters in the URL to bypass the previous fix. The attack triggers only when a user follows or is redirected via the malicious URL, making it dependent on user interaction but relatively straightforward to execute once an injection point is identified. No authentication or special privileges are required on the attacker's side.

Remediation

Upgrade WebOb to version 1.8.10 or later. Organizations should prioritize this patch for any Python application that processes HTTP redirects, particularly those exposed to user-controlled redirect parameters. Review application code for any custom redirect handling that may be similarly vulnerable to whitespace-based URL parsing bypasses.

Patch guidance

Verify the installed WebOb version using pip show webob or similar package management tools. Update using pip install --upgrade webob or equivalent in your dependency management system. Confirm that the upgraded version is 1.8.10 or later. Test redirect functionality in development and staging environments before deploying to production. No configuration changes are required; the fix is in the core URL normalization logic.

Detection guidance

Monitor for suspicious redirect URLs containing embedded whitespace characters (tabs, carriage returns, newlines) in request logs and HTTP Location headers. Search for URLs with protocol-relative paths (//) followed by unfamiliar domain names in redirect responses. Implement HTTP response header inspection to catch malformed or suspicious Location values before they reach end users. Application-level logging of redirect sources and destinations can reveal injection attempts. Review WebOb version in dependency trees across your infrastructure to identify unpatched instances.

Why prioritize this

Although CVSS 6.1 is Medium severity, the practical risk is significant: open redirects are common attack vectors for credential theft and are frequently chained with social engineering. The vulnerability bypasses a prior fix (CVE-2024-42353), suggesting sophisticated evasion. The fix is straightforward and non-breaking, making patching low-friction. Organizations should prioritize this over other Medium-severity issues if they use WebOb in customer-facing web applications or any role where redirect integrity affects security.

Risk score, explained

The CVSS 6.1 score reflects Network attack vector (no authentication required), Low attack complexity (straightforward URL crafting), user interaction required (user must click/follow the redirect), and Changed scope (can affect other security domains through redirects). The score does not capture the full business risk of open redirects in credential theft scenarios, which often justifies higher-than-CVSS prioritization in practice.

Frequently asked questions