Weaknesses of type CWE-601

1,188 results

Redirecionamento aberto para site não confiável

É quando uma aplicação redireciona o usuário para uma URL fornecida por ele (ou por um atacante) sem validação prévia. O navegador segue o redirecionamento automaticamente, levando a vítima para um site malicioso que pode clonar a interface legítima para roubar credenciais ou distribuir malware, com aparência de vir de um domínio confiável.

Example

Um link do tipo `https://banco.com/redirect?url=https://banco-falso.com` recebe a URL de destino como parâmetro e redireciona direto sem checagem. Atacante envia `https://banco.com/redirect?url=https://phishing.com` em email, e a vítima clica pensando estar acessando o banco.

How to mitigate

Valide sempre a URL de destino contra uma lista branca de domínios permitidos ou use URLs relativas. Se aceitar redirecionamentos dinâmicos, verifique que o host pertence ao seu domínio ou a uma lista explícita de parceiros confiáveis.

CVE-2026-41479MEDIUMAuthlib OAuth 2.0 authorization endpoint open redirects to attacker-controlled redirect_uri on unsupported response_typeEPSS 0.3%CVE-2026-33296LOWAVideo has an Open Redirect via Unvalidated redirectUri in userLogin.phpEPSS 0.3%CVE-2024-49682MEDIUMWordPress Simple Membership plugin <= 4.5.3 - Open Redirection vulnerabilityEPSS 0.3%CVE-2026-34257MEDIUMOpen Redirect vulnerability in SAP NetWeaver Application Server ABAPEPSS 0.3%CVE-2024-43280MEDIUMWordPress Salon Booking System plugin <= 10.8.1 - Open Redirection vulnerabilityEPSS 0.3%CVE-2024-47353MEDIUMWordPress ElementsReady Addons for Elementor plugin <= 6.4.2 - Open Redirection vulnerabilityEPSS 0.3%CVE-2025-54681MEDIUMWordPress Connector for Gravity Forms and Google Sheets Plugin plugin <= 1.2.4 - Open Redirection VulnerabilityEPSS 0.3%CVE-2025-11240MEDIUMOpen redirect vulnerability in KNIME Business HubEPSS 0.3%CVE-2025-47854MEDIUMIn JetBrains TeamCity before 2025.03.2 open redirect was possible on editing VCS Root pageEPSS 0.3%CVE-2023-50345LOWOpen Redirect affects DRYiCE MyXalyticsEPSS 0.3%CVE-2024-27184MEDIUM[20240801] - Core - Inadequate validation of internal URLsEPSS 0.3%CVE-2026-84662MEDIUMJenkins LDAP Plugin 807.809.vd3a_4e5e4ec98 and earlier allows connecting to a specified URL through Stapler data binding, allowing attackersEPSS 0.3%CVE-2025-27424MEDIUMFirefox Mobile iOS Address Bar Spoof Using Server-Side Redirect to non-http SchemeEPSS 0.3%CVE-2026-56330MEDIUMCapgo - Open Redirect via Unvalidated Stripe Billing URLsEPSS 0.3%CVE-2025-62379LOWOpen Redirect in reflex-dev/reflexEPSS 0.3%CVE-2026-2475LOWSecurity Vulnerabilities have been found in IBM Verify Identity Access and IBM Security Verify AccessEPSS 0.3%CVE-2025-9193MEDIUMTOTVS Portal Meu RH Password Reset redirectEPSS 0.3%CVE-2025-2418MEDIUMOpen Redirect in TR7's Web Application FirewallEPSS 0.3%CVE-2025-44109MEDIUMA URL redirection in Pinokio v3.6.23 allows attackers to redirect victim users to attacker-controlled pages.EPSS 0.3%CVE-2026-25149LOWQwik City Open Redirect via fixTrailingSlashEPSS 0.3%