Weaknesses of type CWE-601

1,296 results

Redirecionamento aberto para site não confiável

É quando uma aplicação redireciona o usuário para uma URL fornecida por ele (ou por um atacante) sem validação prévia. O navegador segue o redirecionamento automaticamente, levando a vítima para um site malicioso que pode clonar a interface legítima para roubar credenciais ou distribuir malware, com aparência de vir de um domínio confiável.

Example

Um link do tipo `https://banco.com/redirect?url=https://banco-falso.com` recebe a URL de destino como parâmetro e redireciona direto sem checagem. Atacante envia `https://banco.com/redirect?url=https://phishing.com` em email, e a vítima clica pensando estar acessando o banco.

How to mitigate

Valide sempre a URL de destino contra uma lista branca de domínios permitidos ou use URLs relativas. Se aceitar redirecionamentos dinâmicos, verifique que o host pertence ao seu domínio ou a uma lista explícita de parceiros confiáveis.

CVE-2026-45065LOWSymfony: UrlGenerator Route-Requirement Bypass via Unanchored Regex Alternation → Off-Site //host URL InjectionEPSS 0.3%CVE-2026-112034MEDIUMaircheng-org iWebShop-5 Login Redirect _userInfo.php redirectEPSS 0.3%CVE-2026-82464MEDIUMpac4j-core before 6.5.6 Open Redirect via Backslash LogoutEPSS 0.3%CVE-2024-23664MEDIUMA URL redirection to untrusted site ('open redirect') in Fortinet FortiAuthenticator version 6.6.0, version 6.5.3 and below, version 6.4.9 aEPSS 0.3%CVE-2026-54724MEDIUMKiwi TCMS: Open Redirect via unvalidated next parameter in account confirmation endpointEPSS 0.3%CVE-2023-34224MEDIUMIn JetBrains TeamCity before 2023.05 open redirect during oAuth configuration was possibleEPSS 0.3%CVE-2024-12990MEDIUMruifang-tech Rebuild Admin Verification Page admin-verify redirectEPSS 0.3%CVE-2026-2153MEDIUMmwielgoszewski doorman views.py is_safe_url redirectEPSS 0.3%CVE-2026-66414MEDIUMLeantime Open Redirect in Login Controller via redirectUrl ParameterEPSS 0.3%CVE-2025-49325MEDIUMWordPress Newspack Newsletters plugin <= 3.13.0 - Open Redirection VulnerabilityEPSS 0.3%CVE-2025-6089MEDIUMAstun Technology iShare Maps atCheckJS.aspx redirectEPSS 0.3%CVE-2023-4964HIGHPotential open redirect vulnerability in opentext SMAX and AMX product. EPSS 0.3%CVE-2026-63768MEDIUMcal.diy 6.2.0 Conferencing OAuth Callback Open Redirect via Unsigned StateEPSS 0.3%CVE-2024-51321HIGHIn Zucchetti Ad Hoc Infinity 2.4, an improper check on the m_cURL parameter allows an attacker to redirect the victim to an attacker-controlEPSS 0.3%CVE-2026-32824HIGHdataCycle User API Password Reset And Confirmation Flows Trust Attacker- Controlled Redirect TargetsEPSS 0.3%CVE-2025-71403HIGHbetter-auth before 1.1.20 Open Redirect via trustedOrigins BypassEPSS 0.3%CVE-2024-28076HIGHSolarWinds Platform Arbitrary Open Redirection VulnerabilityEPSS 0.3%CVE-2026-53668MEDIUMReact Router: Open redirect can lead to XSSEPSS 0.3%CVE-2024-21065MEDIUMVulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Workflow). Supported versions that are affeEPSS 0.3%CVE-2024-1240MEDIUMOpen Redirection in pyload/pyloadEPSS 0.3%