CVE-2026-54770 (GCVE-0-2026-54770)
Vulnerability from cvelistv5 – Published: 2026-08-20 16:31 – Updated: 2026-08-25 15:04
VLAI
EPSS
VEX
Title
WebOb: Open redirect in Location header normalization via leading C0 control / space characters
Summary
WebOb provides objects for HTTP requests and responses. Prior to 1.8.11, Response._make_location_absolute() in src/webob/response.py checks a Location value for a URI scheme or leading double slash before urllib.parse.urljoin() strips leading C0 control characters and spaces. An attacker-controlled value such as a space followed by a protocol-relative or absolute URL can therefore bypass SCHEME_RE and startswith("//") checks and be normalized to an off-host redirect. Request.relative_url() and webob.exc._HTTPMove subclasses, including HTTPFound, are also affected because they use the same unsafe URL joining behavior or bypass the earlier normalization path. An unauthenticated attacker who can influence an application's redirect target can send users to an attacker-controlled host for phishing or OAuth and SSO token theft, but exploitation requires the user to follow the redirect. This issue is fixed in version 1.8.11.
Severity
6.1 (Medium)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-25 15:03 UTC
CWE
- CWE-601 - URL Redirection to Untrusted Site ('Open Redirect')
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/Pylons/webob/security/advisori… | x_refsource_CONFIRM |
| https://github.com/Pylons/webob/commit/ff89560643… | x_refsource_MISC |
| https://github.com/Pylons/webob/tree/1.8.11 | x_refsource_MISC |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-54770",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-25T15:03:54.011941Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-25T15:04:18.917Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/Pylons/webob/security/advisories/GHSA-6hx8-3wjj-gr8g"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "webob",
"vendor": "Pylons",
"versions": [
{
"status": "affected",
"version": "\u003c 1.8.11"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "WebOb provides objects for HTTP requests and responses. Prior to 1.8.11, Response._make_location_absolute() in src/webob/response.py checks a Location value for a URI scheme or leading double slash before urllib.parse.urljoin() strips leading C0 control characters and spaces. An attacker-controlled value such as a space followed by a protocol-relative or absolute URL can therefore bypass SCHEME_RE and startswith(\"//\") checks and be normalized to an off-host redirect. Request.relative_url() and webob.exc._HTTPMove subclasses, including HTTPFound, are also affected because they use the same unsafe URL joining behavior or bypass the earlier normalization path. An unauthenticated attacker who can influence an application\u0027s redirect target can send users to an attacker-controlled host for phishing or OAuth and SSO token theft, but exploitation requires the user to follow the redirect. This issue is fixed in version 1.8.11."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-601",
"description": "CWE-601: URL Redirection to Untrusted Site (\u0027Open Redirect\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-20T16:31:46.791Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/Pylons/webob/security/advisories/GHSA-6hx8-3wjj-gr8g",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/Pylons/webob/security/advisories/GHSA-6hx8-3wjj-gr8g"
},
{
"name": "https://github.com/Pylons/webob/commit/ff89560643fb252751b4db8806a283b5377f1f07",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/Pylons/webob/commit/ff89560643fb252751b4db8806a283b5377f1f07"
},
{
"name": "https://github.com/Pylons/webob/tree/1.8.11",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/Pylons/webob/tree/1.8.11"
}
],
"source": {
"advisory": "GHSA-6hx8-3wjj-gr8g",
"discovery": "UNKNOWN"
},
"title": "WebOb: Open redirect in Location header normalization via leading C0 control / space characters"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-54770",
"datePublished": "2026-08-20T16:31:46.791Z",
"dateReserved": "2026-06-15T23:23:57.713Z",
"dateUpdated": "2026-08-25T15:04:18.917Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"vulnerability-lookup:meta": {
"epss": {
"cve": "CVE-2026-54770",
"date": "2026-10-20",
"epss": "0.00421",
"percentile": "0.35091"
},
"microsoft_vex": {
"current_release_date": "2026-08-25T01:07:11.000Z",
"cve": "CVE-2026-54770",
"id": "msrc_CVE-2026-54770",
"initial_release_date": "2026-08-25T01:07:11.000Z",
"product_status:known_affected": "1",
"source": "Microsoft CSAF VEX",
"status": "final",
"title": "WebOb: Open redirect in Location header normalization via leading C0 control / space characters",
"url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-54770.json",
"version": "1"
},
"nvd": {
"cve": {
"affected": [
{
"affectedData": [
{
"product": "webob",
"vendor": "Pylons",
"versions": [
{
"status": "affected",
"version": "\u003c 1.8.11"
}
]
}
],
"source": "security-advisories@github.com"
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "WebOb provides objects for HTTP requests and responses. Prior to 1.8.11, Response._make_location_absolute() in src/webob/response.py checks a Location value for a URI scheme or leading double slash before urllib.parse.urljoin() strips leading C0 control characters and spaces. An attacker-controlled value such as a space followed by a protocol-relative or absolute URL can therefore bypass SCHEME_RE and startswith(\"//\") checks and be normalized to an off-host redirect. Request.relative_url() and webob.exc._HTTPMove subclasses, including HTTPFound, are also affected because they use the same unsafe URL joining behavior or bypass the earlier normalization path. An unauthenticated attacker who can influence an application\u0027s redirect target can send users to an attacker-controlled host for phishing or OAuth and SSO token theft, but exploitation requires the user to follow the redirect. This issue is fixed in version 1.8.11."
},
{
"lang": "es",
"value": "WebOb proporciona objetos para solicitudes y respuestas HTTP. Antes de la versi\u00f3n 1.8.11, Response._make_location_absolute() en src/webob/response.py verifica un valor de Location en busca de un esquema URI o una doble barra inicial antes de que urllib.parse.urljoin() elimine los caracteres de control C0 iniciales y los espacios. Un valor controlado por el atacante, como un espacio seguido de una URL relativa al protocolo o absoluta, puede, por lo tanto, eludir las comprobaciones de SCHEME_RE y startswith(\u201c//\u201d) y ser normalizado a una redirecci\u00f3n fuera del host. Request.relative_url() y las subclases de webob.exc._HTTPMove, incluyendo HTTPFound, tambi\u00e9n se ven afectadas porque utilizan el mismo comportamiento inseguro de uni\u00f3n de URL o eluden la ruta de normalizaci\u00f3n anterior. Un atacante no autenticado que puede influir en el objetivo de redirecci\u00f3n de una aplicaci\u00f3n puede enviar a los usuarios a un host controlado por el atacante para phishing o robo de tokens de OAuth y SSO, pero la explotaci\u00f3n requiere que el usuario siga la redirecci\u00f3n. Este problema se ha solucionado en la versi\u00f3n 1.8.11."
}
],
"id": "CVE-2026-54770",
"lastModified": "2026-10-18T20:10:00.110",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"exploitabilityScore": 2.8,
"impactScore": 2.7,
"source": "security-advisories@github.com",
"type": "Secondary"
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"id": "CVE-2026-54770",
"options": [
{
"exploitation": "poc"
},
{
"automatable": "no"
},
{
"technicalImpact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-25T15:03:54.011941Z",
"version": "2.0.3"
}
}
]
},
"published": "2026-08-20T17:18:18.277",
"references": [
{
"source": "security-advisories@github.com",
"url": "https://github.com/Pylons/webob/commit/ff89560643fb252751b4db8806a283b5377f1f07"
},
{
"source": "security-advisories@github.com",
"url": "https://github.com/Pylons/webob/security/advisories/GHSA-6hx8-3wjj-gr8g"
},
{
"source": "security-advisories@github.com",
"url": "https://github.com/Pylons/webob/tree/1.8.11"
},
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"url": "https://github.com/Pylons/webob/security/advisories/GHSA-6hx8-3wjj-gr8g"
}
],
"sourceIdentifier": "security-advisories@github.com",
"vulnStatus": "Deferred",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-601"
}
],
"source": "security-advisories@github.com",
"type": "Secondary"
}
]
}
},
"redhat_vex": {
"aggregate_severity": "Important",
"current_release_date": "2026-10-12T21:10:16+00:00",
"cve": "CVE-2026-54770",
"id": "CVE-2026-54770",
"initial_release_date": "2026-08-20T16:31:46.791000+00:00",
"product_status:fixed": "22",
"product_status:known_affected": "172",
"product_status:known_not_affected": "139",
"source": "Red Hat CSAF VEX",
"status": "final",
"title": "webob: WebOb: Open redirect vulnerability leading to phishing and token theft",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-54770.json",
"version": "3"
},
"vulnrichment": {
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-54770",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-25T15:03:54.011941Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-25T15:04:11.313Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/Pylons/webob/security/advisories/GHSA-6hx8-3wjj-gr8g"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "webob",
"vendor": "Pylons",
"versions": [
{
"status": "affected",
"version": "\u003c 1.8.11"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "WebOb provides objects for HTTP requests and responses. Prior to 1.8.11, Response._make_location_absolute() in src/webob/response.py checks a Location value for a URI scheme or leading double slash before urllib.parse.urljoin() strips leading C0 control characters and spaces. An attacker-controlled value such as a space followed by a protocol-relative or absolute URL can therefore bypass SCHEME_RE and startswith(\"//\") checks and be normalized to an off-host redirect. Request.relative_url() and webob.exc._HTTPMove subclasses, including HTTPFound, are also affected because they use the same unsafe URL joining behavior or bypass the earlier normalization path. An unauthenticated attacker who can influence an application\u0027s redirect target can send users to an attacker-controlled host for phishing or OAuth and SSO token theft, but exploitation requires the user to follow the redirect. This issue is fixed in version 1.8.11."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-601",
"description": "CWE-601: URL Redirection to Untrusted Site (\u0027Open Redirect\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-20T16:31:46.791Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/Pylons/webob/security/advisories/GHSA-6hx8-3wjj-gr8g",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/Pylons/webob/security/advisories/GHSA-6hx8-3wjj-gr8g"
},
{
"name": "https://github.com/Pylons/webob/commit/ff89560643fb252751b4db8806a283b5377f1f07",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/Pylons/webob/commit/ff89560643fb252751b4db8806a283b5377f1f07"
},
{
"name": "https://github.com/Pylons/webob/tree/1.8.11",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/Pylons/webob/tree/1.8.11"
}
],
"source": {
"advisory": "GHSA-6hx8-3wjj-gr8g",
"discovery": "UNKNOWN"
},
"title": "WebOb: Open redirect in Location header normalization via leading C0 control / space characters"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-54770",
"datePublished": "2026-08-20T16:31:46.791Z",
"dateReserved": "2026-06-15T23:23:57.713Z",
"dateUpdated": "2026-08-25T15:04:18.917Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
}
}
Loading…
Loading…
Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline
Sightings and recorded dates, grouped by day · UTC
Loading timeline…
Loading…
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Loading…
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.