Weaknesses of type CWE-601

1,296 results

Redirecionamento aberto para site não confiável

É quando uma aplicação redireciona o usuário para uma URL fornecida por ele (ou por um atacante) sem validação prévia. O navegador segue o redirecionamento automaticamente, levando a vítima para um site malicioso que pode clonar a interface legítima para roubar credenciais ou distribuir malware, com aparência de vir de um domínio confiável.

Example

Um link do tipo `https://banco.com/redirect?url=https://banco-falso.com` recebe a URL de destino como parâmetro e redireciona direto sem checagem. Atacante envia `https://banco.com/redirect?url=https://phishing.com` em email, e a vítima clica pensando estar acessando o banco.

How to mitigate

Valide sempre a URL de destino contra uma lista branca de domínios permitidos ou use URLs relativas. Se aceitar redirecionamentos dinâmicos, verifique que o host pertence ao seu domínio ou a uma lista explícita de parceiros confiáveis.

CVE-2025-27424MEDIUMFirefox Mobile iOS Address Bar Spoof Using Server-Side Redirect to non-http SchemeEPSS 0.3%CVE-2025-40545MEDIUMSolarWinds Observability Self-Hosted Open Redirection VulnerabilityEPSS 0.3%CVE-2026-33397MEDIUMAngular SSR Vulnerable to Protocol-Relative URL Injection via Single Backslash BypassEPSS 0.3%CVE-2026-43924MEDIUMFOSSBilling has an open redirect via administrator-configured redirect targetsEPSS 0.3%CVE-2026-1406MEDIUMlcg0124 BootDo Host Header AccessControlFilter.java redirectToLoginEPSS 0.3%CVE-2025-42985MEDIUMOpen Redirect vulnerability in SAP BusinessObjects Content Administrator workbenchEPSS 0.3%CVE-2026-86351MEDIUMMISP User Homepage Validation Allows Authenticated Open Redirect via Protocol-Relative URLEPSS 0.3%CVE-2026-53436MEDIUMJenkins 2.567 and earlier, LTS 2.555.2 and earlier improperly determines that a redirect URL after login is legitimately pointing to JenkinsEPSS 0.3%CVE-2026-53989MEDIUMDockhand < 1.0.36 Open Redirect via OIDC Initiation EndpointEPSS 0.3%CVE-2025-69725MEDIUMAn Open Redirect vulnerability in the go-chi/chi >=5.2.2 RedirectSlashes function allows remote attackers to redirect victim users to maliciEPSS 0.3%CVE-2026-112040MEDIUMdiem-project diem Sign-In BasedmUserActions.class.php redirectEPSS 0.3%CVE-2026-40080MEDIUMCacti: Open Redirect via HTTP_REFERER substring check in auth_login_redirectEPSS 0.3%CVE-2026-41479MEDIUMAuthlib OAuth 2.0 authorization endpoint open redirects to attacker-controlled redirect_uri on unsupported response_typeEPSS 0.3%CVE-2024-43794MEDIUMOpenSearch Dashboards Security Plugin improper validation of nextUrl can lead to external redirectEPSS 0.3%CVE-2025-67852LOWMoodle: moodle: open redirect vulnerability in oauth login flow allows redirection to malicious sites.EPSS 0.3%CVE-2026-54915MEDIUMTautulli: Open redirect via whitespace bypass in /auth/redirectEPSS 0.3%CVE-2024-43280MEDIUMWordPress Salon Booking System plugin <= 10.8.1 - Open Redirection vulnerabilityEPSS 0.3%CVE-2024-47353MEDIUMWordPress ElementsReady Addons for Elementor plugin <= 6.4.2 - Open Redirection vulnerabilityEPSS 0.3%CVE-2026-28413MEDIUMProducts.isurlinportal: Possible open redirect when using more than 2 forward slashesEPSS 0.3%CVE-2025-61782MEDIUMOpen Redirect in OpenCTI's SAML Authentication FlowEPSS 0.3%