Falhas do tipo CWE-601

1.190 resultados

Redirecionamento aberto (Open Redirect)

É quando uma aplicação redireciona o usuário para uma URL fornecida por ele (parâmetro, query string, etc.) sem validar se o destino é confiável. Um atacante controla para onde a vítima é levada, usando a reputação da aplicação legítima para enganá-la e roubar credenciais ou distribuir malware.

Exemplo

Um site de login tem `redirect.php?url=https://exemplo.com/dashboard`. O atacante muda para `redirect.php?url=https://site-falso.com` e envia o link falso por phishing. A vítima clica confiando no domínio legítimo e acaba em um site fake que coleta suas credenciais.

Como mitigar

Valide e whitelist as URLs permitidas antes de redirecionar — nunca confie no input do usuário. Alternativamente, use IDs ou tokens que mapeiem para destinos pré-aprovados, ou verifique se a URL pertence ao mesmo domínio (validação com regex ou parsing seguro da URL).

CVE-2026-34257MEDIUMOpen Redirect vulnerability in SAP NetWeaver Application Server ABAPEPSS 0.3%CVE-2026-54915MEDIUMTautulli: Open redirect via whitespace bypass in /auth/redirectEPSS 0.3%CVE-2026-40080MEDIUMCacti: Open Redirect via HTTP_REFERER substring check in auth_login_redirectEPSS 0.3%CVE-2026-35404MEDIUMOpen edX Platform has an Open Redirect in Survey Views via Unvalidated redirect_url ParameterEPSS 0.3%CVE-2024-43794MEDIUMOpenSearch Dashboards Security Plugin improper validation of nextUrl can lead to external redirectEPSS 0.3%CVE-2024-47353MEDIUMWordPress ElementsReady Addons for Elementor plugin <= 6.4.2 - Open Redirection vulnerabilityEPSS 0.3%CVE-2025-54681MEDIUMWordPress Connector for Gravity Forms and Google Sheets Plugin plugin <= 1.2.4 - Open Redirection VulnerabilityEPSS 0.3%CVE-2026-97325MEDIUMYunaiV/zhijiantianya ruoyi-vue-pro OAuth2 Client OAuth2ClientServiceImpl.java validOAuthClientFromCache redirectEPSS 0.3%CVE-2023-50345LOWOpen Redirect affects DRYiCE MyXalyticsEPSS 0.3%CVE-2025-11240MEDIUMOpen redirect vulnerability in KNIME Business HubEPSS 0.3%CVE-2025-47854MEDIUMIn JetBrains TeamCity before 2025.03.2 open redirect was possible on editing VCS Root pageEPSS 0.3%CVE-2026-84662MEDIUMJenkins LDAP Plugin 807.809.vd3a_4e5e4ec98 and earlier allows connecting to a specified URL through Stapler data binding, allowing attackersEPSS 0.3%CVE-2025-27424MEDIUMFirefox Mobile iOS Address Bar Spoof Using Server-Side Redirect to non-http SchemeEPSS 0.3%CVE-2024-27184MEDIUM[20240801] - Core - Inadequate validation of internal URLsEPSS 0.3%CVE-2026-2475LOWSecurity Vulnerabilities have been found in IBM Verify Identity Access and IBM Security Verify AccessEPSS 0.3%CVE-2026-56330MEDIUMCapgo - Open Redirect via Unvalidated Stripe Billing URLsEPSS 0.3%CVE-2025-62379LOWOpen Redirect in reflex-dev/reflexEPSS 0.3%CVE-2025-9193MEDIUMTOTVS Portal Meu RH Password Reset redirectEPSS 0.3%CVE-2026-25149LOWQwik City Open Redirect via fixTrailingSlashEPSS 0.3%CVE-2025-44109MEDIUMA URL redirection in Pinokio v3.6.23 allows attackers to redirect victim users to attacker-controlled pages.EPSS 0.3%