Weaknesses of type CWE-601

1,296 results

Redirecionamento aberto para site não confiável

É quando uma aplicação redireciona o usuário para uma URL fornecida por ele (ou por um atacante) sem validação prévia. O navegador segue o redirecionamento automaticamente, levando a vítima para um site malicioso que pode clonar a interface legítima para roubar credenciais ou distribuir malware, com aparência de vir de um domínio confiável.

Example

Um link do tipo `https://banco.com/redirect?url=https://banco-falso.com` recebe a URL de destino como parâmetro e redireciona direto sem checagem. Atacante envia `https://banco.com/redirect?url=https://phishing.com` em email, e a vítima clica pensando estar acessando o banco.

How to mitigate

Valide sempre a URL de destino contra uma lista branca de domínios permitidos ou use URLs relativas. Se aceitar redirecionamentos dinâmicos, verifique que o host pertence ao seu domínio ou a uma lista explícita de parceiros confiáveis.

CVE-2026-118177CRITICALCalendar discovery accepted local file and remote network share locationsEPSS 0.5%CVE-2023-45762MEDIUMWordPress Responsive Column Widgets Plugin <= 1.2.7 is vulnerable to Open RedirectionEPSS 0.5%CVE-2026-83500MEDIUMWindows BitLocker Security Feature Bypass VulnerabilityEPSS 0.4%CVE-2024-25559MEDIUMURL spoofing vulnerability exists in a-blog cms Ver.3.1.0 to Ver.3.1.8. If an attacker sends a specially crafted request, the administrator EPSS 0.4%CVE-2026-3872HIGHKeycloak: keycloak: information disclosure due to redirect_uri validation bypassEPSS 0.4%CVE-2026-54603HIGHOAuth2::Client#request: Protocol-relative redirect Location overrides authority, leaking bearer Authorization to attacker hostEPSS 0.4%CVE-2025-63784MEDIUMAn Open Redirect vulnerability exists in the OAuth callback handler in file onlook/apps/web/client/src/app/auth/callback/route.ts in Onlook EPSS 0.4%CVE-2026-12804MEDIUMlemonldap-ng SAML Common Domain Cookie Endpoint CDC.pm redirectEPSS 0.4%CVE-2026-16336MEDIUMtrinodb trino OAuth2/OIDC ExternalUriInfo.java redirectEPSS 0.4%CVE-2025-20317HIGHCisco UCS Virtual Keyboard Video Monitor (vKVM) Open Redirect VulnerabilityEPSS 0.4%CVE-2026-101090CRITICALNezha through 2.2.3 Host Header Injection via OAuth2 redirect_uriEPSS 0.4%CVE-2023-3922LOWURL Redirection to Untrusted Site ('Open Redirect') in GitLabEPSS 0.4%CVE-2023-50456MEDIUMAn issue was discovered in Zammad before 6.2.0. An attacker can trigger phishing links in generated notification emails via a crafted first EPSS 0.4%CVE-2025-25012MEDIUMKibana Open RedirectEPSS 0.4%CVE-2025-31821MEDIUMWordPress Integration of Zoho CRM and Contact Form 7 plugin <= 1.0.6 - Open Redirection VulnerabilityEPSS 0.4%CVE-2026-3049MEDIUMhorilla-opensource horilla Query Parameter global_search.py get redirectEPSS 0.4%CVE-2023-6812MEDIUMWP Compress – Image Optimizer [All-In-One] <= 6.20.01 - Open Redirect via cssEPSS 0.4%CVE-2024-7902MEDIUMpkp ojs signOut redirectEPSS 0.4%CVE-2026-59806MEDIUMGradio < 6.20.0 - Open Redirect and SSRF via /gradio_api/file= endpointEPSS 0.4%CVE-2026-71428CRITICALunstructured: Server-Side Request Forgery in the URL-based partitioningEPSS 0.4%