CWE-601

Low likelihood

URL Redirection to Untrusted Site ('Open Redirect')

Parent: CWE-610 - Externally Controlled Reference to a Resource in Another Sphere

The web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a redirect.

1,629 vulnerabilities with CWE-601

CVE-2026-33296 MEDIUM

AVideo <26.0 userLogin.php redirectUri - Open Redirect

CVSS 6.1

CVE-2026-29105 MEDIUM

SuiteCRM has Unauthenticated Open Redirect in Leads WebToLead Capture

CVSS 5.4

CVE-2026-20994 MEDIUM

Samsung Account <15.5.01.1 - Open Redirect

CVSS 6.1

CVE-2026-32235 MEDIUM

Backstage plugin-auth-backend < 0.27.1 - Open Redirect via OIDC Provider Redirect URI Bypass

CVSS 5.9

CVE-2026-2376 MEDIUM

mirror-registry - Redirect-Based Server-Side Request Forgery

CVSS 4.9

CVE-2026-3824 MEDIUM

WellChoose Organization Portal System < iftop_p4_181 - Authenticated Open Redirect

CVSS 6.1

CVE-2026-23817 MEDIUM

HPE AOS-CX Unauthenticated Open Redirect via Web Management Interface

CVSS 6.5

CVE-2026-21295 LOW

Adobe Commerce <=2.4.9-alpha3 - Open Redirect

CVSS 3.1

CVE-2026-31819 MEDIUM

Sylius < 1.9.12 - Open Redirect via HTTP Referer Header

CVSS 6.1

CVE-2026-28512 HIGH

Pocket ID 2.0.0-2.3.9 - Open Redirect

CVSS 7.1

CVE-2026-29067 HIGH

ZITADEL 4.0.0-rc.1-4.7.0 - Open Redirect

CVSS 8.1

CVE-2026-28106 MEDIUM

B2BKing Premium <=5.3.80 - Open Redirect

CVSS 4.7

CVE-2026-28681 HIGH

IRRd 4.4.0-4.4.4/4.5.0 - Open Redirect

CVSS 8.1

CVE-2026-28413 MEDIUM

Products.isurlinportal <4.0.0 - Open Redirect

CVSS 5.3

CVE-2026-27982 MEDIUM

django-allauth <65.14.1 - Open Redirect

CVSS 6.1

CVE-2026-25477 MEDIUM

affine < 0.26.0 - Open Redirect via Improperly Anchored Regular Expression

CVSS 6.1

CVE-2026-28415 MEDIUM

Gradio < 6.6.0 - Open Redirect via Unvalidated _target_url Parameter

CVSS 4.3

CVE-2026-27738 MEDIUM

Angular SSR <19.2.21/20.3.17/21.1.5 - Open Redirect

CVE-2026-27736 MEDIUM

BigBlueButton 3.x <3.0.20 - Open Redirect

CVSS 6.1

CVE-2026-28194 MEDIUM

JetBrains TeamCity <2025.11.3 - Open Redirect

CVSS 4.3

CVE-2026-24847 MEDIUM

OpenEMR < 8.0.0 - Authenticated Open Redirect via Eye Exam Form Module

CVSS 6.1

CVE-2026-3049 MEDIUM

horilla-opensource horilla <=1.0.2 - Open Redirect

CVSS 4.3

CVE-2026-25649 HIGH

Traccar <= 6.11.1 - Authenticated Open Redirect via OIDC Endpoint redirect_uri Parameter

CVSS 7.3

CVE-2026-1369 MEDIUM

Conditional CAPTCHA WordPress Plugin <4.0.0 - Open Redirect

CVSS 4.3

CVE-2026-27191 MEDIUM

Feathersjs <=5.0.39 - Open Redirect

CVSS 6.1

Details

Vulnerabilities 1,629

Exploit Likelihood Low

Links