Open Redirect

What it is

A redirect target is taken from user input, letting an attacker send victims to a malicious site.

How to fix it

Upgrade and validate the redirect target against an allow-list.

How to avoid it

Only redirect to relative paths or an allow-list of hosts; never to a raw user-supplied URL.

Known Open Redirect vulnerabilities

• CVE-2026-71428 — critical · PyPI/unstructured
• CVE-2026-55461 — medium · Packagist/snipe/snipe-it
• CVE-2026-55834 — medium · Go/github.com/pocket-id/pocket-id/backend
• CVE-2026-54770 — medium · PyPI/webob
• CVE-2026-53728 — high · npm/@medplum/core
• CVE-2026-55087 — medium · npm/ep_etherpad-lite
• CVE-2026-53573 — medium · Maven/org.geonetwork-opensource:geonetwork
• CVE-2026-54588 — critical · Packagist/poweradmin/poweradmin
• CVE-2026-54603 — high · RubyGems/oauth2
• GHSA-38hq-7x33-php4 — medium · npm/@backstage/plugin-auth-backend
• CVE-2026-53669 — medium · npm/react-router
• CVE-2026-53668 — medium · npm/react-router-dom
• CVE-2026-54072 — critical · Go/github.com/authorizerdev/authorizer
• CVE-2026-55252 — medium · Go/github.com/openrundev/openrun
• GHSA-86j7-9j95-vpqj — high · npm/better-auth
• CVE-2026-54724 — medium · PyPI/kiwitcms
• CVE-2026-55431 — high · Go/github.com/coder/coder/v2
• CVE-2026-53935 — medium · Go/github.com/cilium/cilium
• GHSA-9c3v-684m-579c — medium · npm/openclaw
• CVE-2026-49820 — medium · Go/go.probo.inc/probo
• CVE-2026-53523 — medium · Go/github.com/nezhahq/nezha
• GHSA-w2j7-f3c6-g8cw — medium · PyPI/Flask-Security
• CVE-2026-52802 — medium · Go/gogs.io/gogs

Stateward flags Open Redirect in your own code and dependencies on every pull request.

Summarize with AI

ChatGPTClaudePerplexity