Weaknesses of type CWE-601

1,296 results

Redirecionamento aberto para site não confiável

É quando uma aplicação redireciona o usuário para uma URL fornecida por ele (ou por um atacante) sem validação prévia. O navegador segue o redirecionamento automaticamente, levando a vítima para um site malicioso que pode clonar a interface legítima para roubar credenciais ou distribuir malware, com aparência de vir de um domínio confiável.

Example

Um link do tipo `https://banco.com/redirect?url=https://banco-falso.com` recebe a URL de destino como parâmetro e redireciona direto sem checagem. Atacante envia `https://banco.com/redirect?url=https://phishing.com` em email, e a vítima clica pensando estar acessando o banco.

How to mitigate

Valide sempre a URL de destino contra uma lista branca de domínios permitidos ou use URLs relativas. Se aceitar redirecionamentos dinâmicos, verifique que o host pertence ao seu domínio ou a uma lista explícita de parceiros confiáveis.

CVE-2024-4283MEDIUMURL Redirection to Untrusted Site ('Open Redirect') in GitLabEPSS 0.4%CVE-2024-34071MEDIUMOpen Redirect Bypass Protection EPSS 0.4%CVE-2026-83646MEDIUMActive Directory Federation Services (AD FS) Spoofing VulnerabilityEPSS 0.4%CVE-2023-49394MEDIUMZentao versions 4.1.3 and before has a URL redirect vulnerability, which prevents the system from functioning properly.EPSS 0.4%CVE-2026-47026HIGHVulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: OpenSearch Dashboards). Supported versions EPSS 0.4%CVE-2025-23086MEDIUMOn most desktop platforms, Brave Browser versions 1.70.x-1.73.x included a feature to show a site's origin on the OS-provided file selector EPSS 0.4%CVE-2026-55834MEDIUMPocket ID: Open Redirect on the OIDC /authorize page via unvalidated redirect_uri with prompt=noneEPSS 0.4%CVE-2026-29067HIGHZITADEL: Account Takeover Due to Improper Instance Validation in V2 LoginEPSS 0.4%CVE-2026-47070MEDIUMHTTP/3 redirect handler leaks Authorization and Cookie headers to cross-origin redirect target in hackneyEPSS 0.4%CVE-2022-29910MEDIUMWhen closed or sent to the background, Firefox for Android would not properly record and persist HSTS settings.<br>*Note: This issue only afEPSS 0.4%CVE-2025-7949MEDIUMSanluan PublicCMS preview.html redirectEPSS 0.4%CVE-2022-26326MEDIUMPotential open redirection vulnerability in NetIQ Access Manager versions prior to version 5.0.2EPSS 0.4%CVE-2025-6238HIGHAI Engine 2.8.4 - Insecure OAuth ImplementationEPSS 0.4%CVE-2026-69087HIGHGrav Form Plugin before 9.1.13 Open Redirect via form.value() TwigEPSS 0.4%CVE-2024-45981HIGHA host header injection vulnerability in BookReviewLibrary 1.0 allows attackers to obtain the password reset token via user interaction withEPSS 0.4%CVE-2023-40306MEDIUMURL Redirection vulnerability in SAP S/4HANA (Manage Catalog Items and Cross-Catalog search)EPSS 0.4%CVE-2026-44598MEDIUMApache Shiro Jakarta EE module: Open redirect and SSRF (requires valid credentials)EPSS 0.4%CVE-2025-40846HIGHHaloITSM open redirect via the returnUrlEPSS 0.4%CVE-2026-15093MEDIUMMultiple Vulnerabilities in IBM Engineering AI hub.EPSS 0.4%CVE-2025-31871MEDIUMWordPress WP Clone any post type Plugin <= 3.6 - Open Redirect vulnerabilityEPSS 0.4%