Weaknesses of type CWE-601

1,296 results

Redirecionamento aberto para site não confiável

É quando uma aplicação redireciona o usuário para uma URL fornecida por ele (ou por um atacante) sem validação prévia. O navegador segue o redirecionamento automaticamente, levando a vítima para um site malicioso que pode clonar a interface legítima para roubar credenciais ou distribuir malware, com aparência de vir de um domínio confiável.

Example

Um link do tipo `https://banco.com/redirect?url=https://banco-falso.com` recebe a URL de destino como parâmetro e redireciona direto sem checagem. Atacante envia `https://banco.com/redirect?url=https://phishing.com` em email, e a vítima clica pensando estar acessando o banco.

How to mitigate

Valide sempre a URL de destino contra uma lista branca de domínios permitidos ou use URLs relativas. Se aceitar redirecionamentos dinâmicos, verifique que o host pertence ao seu domínio ou a uma lista explícita de parceiros confiáveis.

CVE-2026-55252MEDIUMOpenRun: Redirect URL validation bypass using //host paths leads to Open RedirectEPSS 0.4%CVE-2024-45979HIGHA host header injection vulnerability in Lines Police CAD 1.0 allows attackers to obtain the password reset token via user interaction with EPSS 0.4%CVE-2023-41699MEDIUMPayara Platform: URL Redirection to untrusted site using FORM authenticationEPSS 0.4%CVE-2023-34247MEDIUM@keystone-6/auth Open Redirect vulnerabilityEPSS 0.4%CVE-2025-0970MEDIUMZenvia Movidesk Login redirectEPSS 0.4%CVE-2026-78079MEDIUMJoomla Extension - joomshaper.com - Privileged File Upload Bypass via Content Spoofing in Helix Ultimate < 2.2.10EPSS 0.4%CVE-2026-47377MEDIUMNocoDB: Open Redirect via Hash Fragment in hashRedirect PluginEPSS 0.4%CVE-2023-5445MEDIUM An open redirect vulnerability in ePolicy Orchestrator prior to 5.10.0 CP1 Update 2, allows a remote low privileged user to modify the URL EPSS 0.4%CVE-2026-75114MEDIUMJoomla Extension - yootheme.com - Open redirect in CommentController::twitterAuthenticate() in Zoo < 4.1.64EPSS 0.4%CVE-2021-4260MEDIUMoils-js Web.js redirectEPSS 0.4%CVE-2025-64754LOWJitsi Meet has DOM Redirect on Microsoft OAuth FlowEPSS 0.4%CVE-2024-28113LOWOpen redirection using the return_url parameter in Peering ManagerEPSS 0.4%CVE-2024-33584MEDIUMWordPress Video Conferencing with Zoom plugin <= 4.4.4 - Open Redirection vulnerabilityEPSS 0.4%CVE-2024-46886MEDIUMThe web server of affected devices does not properly validate input that is used for a user redirection. This could allow an attacker to makEPSS 0.4%CVE-2024-31253MEDIUMWordPress WP OAuth Server (OAuth Authentication) plugin <= 4.3.3 - Open Redirection vulnerabilityEPSS 0.4%CVE-2026-66370MEDIUMhtml_sanitize_ex HTML5 scrubber keeps attacker-supplied form-association attributes, allowing form hijackingEPSS 0.4%CVE-2023-47168MEDIUMOpen redirect in /oauth/<service>/mobile_login?redirect_to=EPSS 0.4%CVE-2025-30795MEDIUMWordPress Automation By Autonami plugin <= 3.5.1 - Open Redirection vulnerabilityEPSS 0.4%CVE-2026-34847MEDIUMhoppscotch: Open redirect via `/enter?redirect=`EPSS 0.4%CVE-2022-2237MEDIUMA flaw was found in the Keycloak Node.js Adapter. This flaw allows an attacker to benefit from an Open Redirect vulnerability in the checkSsEPSS 0.4%