Description
An open redirect vulnerability exists in the Account module in Volosoft ABP Framework >= 5.1.0 and < 10.0.0-rc.2. Improper validation of the returnUrl parameter in the register function allows an attacker to redirect users to arbitrary external domains.
Scores
CVSS v3
5.3
EPSS
0.0008
EPSS Percentile
22.8%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
CISA SSVC
Vulnrichment
Exploitation
none
Automatable
no
Technical Impact
partial
Details
CWE
CWE-601
Status
published
Products (3)
nuget/Volo.Abp.Account.Web
5.1.0 - 10.0.0-rc.2NuGet
volosoft/abp
10.0.0 rc1
volosoft/abp
5.1.0 - 10.0.0
Published
Dec 16, 2025
Tracked Since
Feb 18, 2026