Go · go.probo.inc/probo
Probo has an open redirect bypass via path normalization
Probo's saferedirect package validates redirect URLs used across authentication flows (OIDC, SAML, session transfer, OAuth connectors, and trust-center magic links). The validator only inspected the second character of relative paths, so a URL like /../\evil.com passed validation because the second character is .. Go's http.Redirect normalizes this path to /\evil.com before setting the Location header. Browsers can interpret the backslash as a host separator and redirect the user to an external domain (https://evil.com), bypassing the intended same-origin restriction. This enables open-redirect phishing: an attacker can craft a continue parameter (or embed a malicious URL in a session-transfer token) that appears to originate from a trusted Probo domain but redirects victims elsewhere.
Fixed in go.probo.inc/probo by normalizing relative paths with path.Clean before validation, rejecting backslashes (including
percent-encoded %5c) anywhere in the path, and re-checking the normalized result for protocol-relative and backslash prefixes.
Self-hosted deployments should upgrade to probod v0.194.1 or later.
SaaS deployments on getprobo.com are patched.
No practical workaround for self-hosted installations. Upgrade to the patched release.
Is your project exposed to this? Stateward checks every dependency on every pull request and flags it only if your code actually reaches it.
Check my repoSources: CISA KEV (public domain), OSV.dev & GitHub Advisory Database (CC-BY-4.0), FIRST EPSS, NVD/CWE (public domain). Served live from the Stateward advisory database.