Weaknesses of type CWE-601

1,188 results

Redirecionamento aberto para site não confiável

É quando uma aplicação redireciona o usuário para uma URL fornecida por ele (ou por um atacante) sem validação prévia. O navegador segue o redirecionamento automaticamente, levando a vítima para um site malicioso que pode clonar a interface legítima para roubar credenciais ou distribuir malware, com aparência de vir de um domínio confiável.

Example

Um link do tipo `https://banco.com/redirect?url=https://banco-falso.com` recebe a URL de destino como parâmetro e redireciona direto sem checagem. Atacante envia `https://banco.com/redirect?url=https://phishing.com` em email, e a vítima clica pensando estar acessando o banco.

How to mitigate

Valide sempre a URL de destino contra uma lista branca de domínios permitidos ou use URLs relativas. Se aceitar redirecionamentos dinâmicos, verifique que o host pertence ao seu domínio ou a uma lista explícita de parceiros confiáveis.

CVE-2026-33397MEDIUMAngular SSR Vulnerable to Protocol-Relative URL Injection via Single Backslash BypassEPSS 0.3%CVE-2025-47854MEDIUMIn JetBrains TeamCity before 2025.03.2 open redirect was possible on editing VCS Root pageEPSS 0.3%CVE-2025-27424MEDIUMFirefox Mobile iOS Address Bar Spoof Using Server-Side Redirect to non-http SchemeEPSS 0.3%CVE-2026-8323CRITICALOpen Redirect in Armiya Information Technologies' Access Control SystemEPSS 0.3%CVE-2024-27184MEDIUM[20240801] - Core - Inadequate validation of internal URLsEPSS 0.3%CVE-2026-86823MEDIUMNewsletter < 9.3.7 - Unauthenticated Open Redirect and Subscriber Token Disclosure via ncu ParameterEPSS 0.3%CVE-2025-62379LOWOpen Redirect in reflex-dev/reflexEPSS 0.3%CVE-2026-56330MEDIUMCapgo - Open Redirect via Unvalidated Stripe Billing URLsEPSS 0.3%CVE-2026-2475LOWSecurity Vulnerabilities have been found in IBM Verify Identity Access and IBM Security Verify AccessEPSS 0.3%CVE-2025-9193MEDIUMTOTVS Portal Meu RH Password Reset redirectEPSS 0.3%CVE-2026-25149LOWQwik City Open Redirect via fixTrailingSlashEPSS 0.3%CVE-2025-2418MEDIUMOpen Redirect in TR7's Web Application FirewallEPSS 0.3%CVE-2025-47890LOWAn URL Redirection to Untrusted Site vulnerabilities [CWE-601] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4.0 through EPSS 0.3%CVE-2025-44109MEDIUMA URL redirection in Pinokio v3.6.23 allows attackers to redirect victim users to attacker-controlled pages.EPSS 0.3%CVE-2026-94102MEDIUMWuzhiCMS Login index.php redirectEPSS 0.3%CVE-2026-11502LOWJeecgBoot Third-Party Login ThirdLoginController.java HttpServletResponse.sendRedirect redirectEPSS 0.3%CVE-2026-71428CRITICALunstructured: Server-Side Request Forgery in the URL-based partitioningEPSS 0.3%CVE-2026-18721MEDIUMkalcaddle kodbox SSO API Login apiLogin redirectEPSS 0.3%CVE-2025-24868HIGHOpen Redirect Vulnerability in SAP HANA extended application services, advanced model (User Account and Authentication Services)EPSS 0.2%CVE-2026-46688MEDIUMMeeting Room Booking System has an unauthenticated open redirectEPSS 0.2%