Weaknesses of type CWE-601

1,177 results

Redirecionamento aberto para site não confiável

É quando uma aplicação redireciona o usuário para uma URL fornecida por ele (ou por um atacante) sem validação prévia. O navegador segue o redirecionamento automaticamente, levando a vítima para um site malicioso que pode clonar a interface legítima para roubar credenciais ou distribuir malware, com aparência de vir de um domínio confiável.

Example

Um link do tipo `https://banco.com/redirect?url=https://banco-falso.com` recebe a URL de destino como parâmetro e redireciona direto sem checagem. Atacante envia `https://banco.com/redirect?url=https://phishing.com` em email, e a vítima clica pensando estar acessando o banco.

How to mitigate

Valide sempre a URL de destino contra uma lista branca de domínios permitidos ou use URLs relativas. Se aceitar redirecionamentos dinâmicos, verifique que o host pertence ao seu domínio ou a uma lista explícita de parceiros confiáveis.

CVE-2026-53436MEDIUMJenkins 2.567 and earlier, LTS 2.555.2 and earlier improperly determines that a redirect URL after login is legitimately pointing to JenkinsEPSS 0.3%CVE-2026-13277MEDIUMSecurity vulnerabilities have been addressed in IBM Verify Identity Access and IBM Security Verify AccessEPSS 0.3%CVE-2026-58520MEDIUMUrlShortener defaults to ineffective validation open to third-party redirectsEPSS 0.3%CVE-2024-22308LOWWordPress Simple Membership Plugin <= 4.4.1 is vulnerable to Open RedirectionEPSS 0.3%CVE-2026-0484MEDIUMMissing Authorization check in SAP NetWeaver Application Server ABAP and SAP S/4HANAEPSS 0.3%CVE-2026-12985MEDIUMMattermost DCR redirect URI allowlist bypass via improper URL component validationEPSS 0.3%CVE-2026-53668MEDIUMReact Router: Open redirect can lead to XSSEPSS 0.3%CVE-2025-58006MEDIUMWordPress WP Gravity Forms Keap/Infusionsoft plugin <= 1.2.6 - Open Redirection vulnerabilityEPSS 0.3%CVE-2026-41670HIGHAdmidio: SAML Response Sent to Unvalidated Assertion Consumer Service URL from AuthnRequestEPSS 0.3%CVE-2022-44717LOWAn issue was discovered in NetScout nGeniusONE 6.3.2 build 904. Open Redirection can occur (issue 1 of 2). After successful login, an attackEPSS 0.3%CVE-2026-55660HIGHTinaCMS: Cross-origin postMessage handlers and rich-text URL-sanitization bypass enable stored XSS and session takeoverEPSS 0.3%CVE-2024-6377HIGHURL redirection to untrusted site (open redirect) vulnerability affecting 3DPassport in 3DSwymer from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2024xEPSS 0.3%CVE-2025-65581MEDIUMAn open redirect vulnerability exists in the Account module in Volosoft ABP Framework >= 5.1.0 and < 10.0.0-rc.2. Improper validation of theEPSS 0.3%CVE-2024-36406MEDIUMSuiteCRM vulnerable to open redirectsEPSS 0.3%CVE-2026-53586MEDIUMlibgit2: HTTP transport can leak credentials to an offsite redirect targetEPSS 0.3%CVE-2025-62595MEDIUMKoa Vulnerable to Open Redirect via Trailing Double-Slash (//) in back Redirect LogicEPSS 0.3%CVE-2026-41226MEDIUMOpen redirect vulnerability exists in Multiple laser printers and MFPs which implement Ricoh Web Image Monitor. When accessing a specially cEPSS 0.3%CVE-2026-48012MEDIUMShopware SSO referer trust leading to an arbitrary redirect targetEPSS 0.3%CVE-2026-59717MEDIUMHome Assistant Companion: `homeassistant://invite` Deep Link Credential PhishingEPSS 0.3%CVE-2024-47648MEDIUMWordPress EventPrime plugin <= 4.0.4.5 - Open Redirection vulnerabilityEPSS 0.3%