CWE-601— URL Redirection to Untrusted Site (Open Redirect)

The web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a redirect.— MITRE CWE catalog

1,776 active CVEs classified under this weakness category. Sourced from NVD, GHSA, and vendor advisories. Full definition on MITRE →

CVEs classified under CWE-601page 32 of 36

CVE-2024-25559MEDIUMCVSS 4.7EG 4.7
2024-02-15
URL spoofing vulnerability exists in a-blog cms Ver.3.1.0 to Ver.3.1.8. If an attacker sends a specially crafted request, the administrator of the product may be forced to access an arbitrary website when clicking a link in the audit log.
CVE-2024-24808MEDIUMCVSS 4.7EG 4.7
2024-02-06
pyLoad is an open-source Download Manager written in pure Python. There is an open redirect vulnerability due to incorrect validation of input values when redirecting users after login. pyLoad is validating URLs via the `get_redirect_url` …
CVE-2024-21641MEDIUMCVSS 4.7EG 4.7
2024-01-05
Flarum is open source discussion platform software. Prior to version 1.8.5, the Flarum `/logout` route includes a redirect parameter that allows any third party to redirect users from a (trusted) domain of the Flarum installation to redire…
CVE-2023-32517MEDIUMCVSS 4.7EG 4.7
2023-12-29
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in PluginOps MailChimp Subscribe Form, Optin Builder, PopUp Builder, Form Builder.This issue affects MailChimp Subscribe Form, Optin Builder, PopUp Builder, Form Builder: fr…
CVE-2023-32101MEDIUMCVSS 4.7EG 4.7
2023-12-29
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Pexle Chris Library Viewer.This issue affects Library Viewer: from n/a through 2.0.6.
CVE-2023-31237MEDIUMCVSS 4.7EG 4.7
2023-12-29
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Dylan James Zephyr Project Manager.This issue affects Zephyr Project Manager: from n/a through 3.3.9.
CVE-2023-31229MEDIUMCVSS 4.7EG 4.7
2023-12-29
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in WP Directory Kit.This issue affects WP Directory Kit: from n/a through 1.1.9.
CVE-2023-31095MEDIUMCVSS 4.7EG 4.7
2023-12-29
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in CRM Perks Integration for HubSpot and Contact Form 7, WPForms, Elementor, Ninja Forms.This issue affects Integration for HubSpot and Contact Form 7, WPForms, Elementor, N…
CVE-2023-37982MEDIUMCVSS 4.7EG 4.7
2023-12-19
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in CRM Perks Integration for Salesforce and Contact Form 7, WPForms, Elementor, Ninja Forms.This issue affects Integration for Salesforce and Contact Form 7, WPForms, Elemen…
CVE-2023-35883MEDIUMCVSS 4.7EG 4.7
2023-12-19
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Magazine3 Core Web Vitals & PageSpeed Booster.This issue affects Core Web Vitals & PageSpeed Booster: from n/a through 1.0.12.
CVE-2023-40602MEDIUMCVSS 4.7EG 4.7
2023-12-19
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Doofinder Doofinder WP & WooCommerce Search.This issue affects Doofinder WP & WooCommerce Search: from n/a through 1.5.49.
CVE-2023-38481MEDIUMCVSS 4.7EG 4.7
2023-12-19
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in CRM Perks Integration for WooCommerce and Zoho CRM, Books, Invoice, Inventory, Bigin.This issue affects Integration for WooCommerce and Zoho CRM, Books, Invoice, Inventor…
CVE-2023-38478MEDIUMCVSS 4.7EG 4.7
2023-12-19
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in CRM Perks Integration for WooCommerce and QuickBooks.This issue affects Integration for WooCommerce and QuickBooks: from n/a through 1.2.3.
CVE-2023-6545MEDIUMCVSS 4.7EG 4.7
2023-12-14
The package authelia-bhf included in Beckhoffs TwinCAT/BSD is prone to an open redirect that allows a remote unprivileged attacker to redirect a user to another site. This may have limited impact to integrity and does solely affect antheli…
CVE-2023-20263MEDIUMCVSS 4.7EG 4.7
2023-09-06
A vulnerability in the web-based management interface of Cisco HyperFlex HX Data Platform could allow an unauthenticated, remote attacker to redirect a user to a malicious web page. This vulnerability is due to improper input validati…
CVE-2022-27861MEDIUMCVSS 4.7EG 4.7
2023-08-10
Unauth. Open Redirect vulnerability in Arscode Ninja Popups plugin <= 4.7.5 versions.
CVE-2023-28020MEDIUMCVSS 4.7EG 4.7
2023-07-18
URL redirection in Login page in HCL BigFix WebUI allows malicious user to redirect the client browser to an external site via redirect URL response header.
CVE-2023-29204MEDIUMCVSS 4.7EG 4.7
2023-04-15
XWiki Commons are technical libraries common to several other top level XWiki projects. It is possible to bypass the existing security measures put in place to avoid open redirect by using a redirect such as `//mydomain.com` (i.e. omitting…
CVE-2022-3145MEDIUMCVSS 4.7EG 4.7
2023-01-12
An open redirect vulnerability exists in Okta OIDC Middleware prior to version 5.0.0 allowing an attacker to redirect a user to an arbitrary URL.
CVE-2022-23527MEDIUMCVSS 4.7EG 4.7
2022-12-14
mod_auth_openidc is an OpenID Certified™ authentication and authorization module for the Apache 2.x HTTP server. Versions prior to 2.4.12.2 are vulnerable to Open Redirect. When providing a logout parameter to the redirect URI, the exist…
CVE-2022-41215MEDIUMCVSS 4.7EG 4.7
2022-11-08
SAP NetWeaver ABAP Server and ABAP Platform allows an unauthenticated attacker to redirect users to a malicious site due to insufficient URL validation. This could lead to the user being tricked to disclose personal information.
CVE-2022-30562MEDIUMCVSS 4.7EG 4.7
2022-06-28
If the user enables the https function on the device, an attacker can modify the user’s request data packet through a man-in-the-middle attack ,Injection of a malicious URL in the Host: header of the HTTP Request results in a 302 redirec…
CVE-2022-28215MEDIUMCVSS 4.7EG 4.7
2022-04-12
SAP NetWeaver ABAP Server and ABAP Platform - versions 740, 750, 787, allows an unauthenticated attacker to redirect users to a malicious site due to insufficient URL validation. This could lead to the user being tricked to disclose person…
CVE-2021-41180MEDIUMCVSS 4.7EG 4.7
2022-03-08
Nextcloud talk is a self hosting messaging service. In versions prior 12.1.2 an attacker is able to control the link of a geolocation preview in the Nextcloud Talk application due to a lack of validation on the link. This could result in a…
CVE-2022-23618MEDIUMCVSS 4.7EG 4.7
2022-02-09
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In affected versions there is no protection against URL redirection to untrusted sites, in particular some well known parameters (xred…
CVE-2021-34772MEDIUMCVSS 4.7EG 4.7
2021-10-06
A vulnerability in the web-based management interface of Cisco Orbital could allow an unauthenticated, remote attacker to redirect users to a malicious webpage. This vulnerability is due to improper validation of URL paths in the web-based…
CVE-2021-39191MEDIUMCVSS 4.7EG 4.7
2021-09-03
mod_auth_openidc is an authentication/authorization module for the Apache 2.x HTTP server that functions as an OpenID Connect Relying Party, authenticating users against an OpenID Connect Provider. In versions prior to 2.4.9.4, the 3rd-par…
CVE-2021-32786MEDIUMCVSS 4.7EG 4.7
2021-07-22
mod_auth_openidc is an authentication/authorization module for the Apache 2.x HTTP server that functions as an OpenID Connect Relying Party, authenticating users against an OpenID Connect Provider. In versions prior to 2.4.9, `oidc_validat…
CVE-2021-32721MEDIUMCVSS 4.7EG 4.7
2021-06-29
PowerMux is a drop-in replacement for Go's http.ServeMux. In PowerMux versions prior to 1.1.1, attackers may be able to craft phishing links and other open redirects by exploiting the trailing slash redirection feature. This may lead to us…
CVE-2021-1525MEDIUMCVSS 4.7EG 4.7
2021-06-04
A vulnerability in Cisco Webex Meetings and Cisco Webex Meetings Server could allow an unauthenticated, remote attacker to redirect users to a malicious file. This vulnerability is due to improper validation of URL paths in the application…
CVE-2021-1358MEDIUMCVSS 4.7EG 4.7
2021-05-22
A vulnerability in the web-based management interface of Cisco Finesse could allow an unauthenticated, remote attacker to redirect a user to an undesired web page. This vulnerability is due to improper input validation of the URL parameter…
CVE-2021-1397MEDIUMCVSS 4.7EG 4.7
2021-05-06
A vulnerability in the web-based management interface of Cisco Integrated Management Controller (IMC) Software could allow an unauthenticated, remote attacker to redirect a user to a malicious web page. This vulnerability is due to imprope…
CVE-2021-21338MEDIUMCVSS 4.7EG 4.7
2021-03-23
TYPO3 is an open source PHP based web content management system. In TYPO3 before versions 6.2.57, 7.6.51, 8.7.40, 9.5.25, 10.4.14, 11.1.1 it has been discovered that Login Handling is susceptible to open redirection which allows attackers …
CVE-2021-21291MEDIUMCVSS 4.7EG 4.7
2021-02-02
OAuth2 Proxy is an open-source reverse proxy and static file server that provides authentication using Providers (Google, GitHub, and others) to validate accounts by email, domain or group. In OAuth2 Proxy before version 7.0.0, for users t…
CVE-2021-1310MEDIUMCVSS 4.7EG 4.7
2021-01-13
A vulnerability in the web-based management interface of Cisco Webex Meetings could allow an unauthenticated, remote attacker to redirect a user to an untrusted web page, bypassing the warning mechanism that should prompt the user before t…
CVE-2020-26219MEDIUMCVSS 4.7EG 4.7
2020-11-11
touchbase.ai before version 2.0 is vulnerable to Open Redirect. Impacts can be many, and vary from theft of information and credentials, to the redirection to malicious websites containing attacker-controlled content, which in some cases e…
CVE-2020-15241MEDIUMCVSS 4.7EG 4.7
2020-10-08
TYPO3 Fluid Engine (package `typo3fluid/fluid`) before versions 2.0.5, 2.1.4, 2.2.1, 2.3.5, 2.4.1, 2.5.5 or 2.6.1 is vulnerable to cross-site scripting when making use of the ternary conditional operator in templates like `{showFullName ? …
CVE-2020-15242MEDIUMCVSS 4.7EG 4.7
2020-10-08
Next.js versions >=9.5.0 and <9.5.4 are vulnerable to an Open Redirect. Specially encoded paths could be used with the trailing slash redirect to allow an open redirect to occur to an external site. In general, this redirect does not direc…
CVE-2020-7520MEDIUMCVSS 4.7EG 4.7
2020-07-23
A CWE-601: URL Redirection to Untrusted Site ('Open Redirect') vulnerability exists in Schneider Electric Software Update (SESU), V2.4.0 and prior, which could cause execution of malicious code on the victim's machine. In order to exploit …
CVE-2017-6932MEDIUMCVSS 4.7EG 4.7
2018-03-01
Drupal core 7.x versions before 7.57 has an external link injection vulnerability when the language switcher block is used. A similar vulnerability exists in various custom and contributed modules. This vulnerability could allow an attacke…
CVE-2026-2813MEDIUMCVSS 4.1EG 4.7
2026-05-20
ArcGIS Server contains an input validation weakness in the login redirection workflow. An Authenticated attacker could exploit this issue by sending a specially crafted request, Successful exploitation may result in the application redirec…
CVE-2025-49592MEDIUMCVSS 4.6EG 4.6
2025-06-26
n8n is a workflow automation platform. Versions prior to 1.98.0 have an Open Redirect vulnerability in the login flow. Authenticated users can be redirected to untrusted, attacker-controlled domains after logging in, by crafting malicious …
CVE-2020-29537MEDIUMCVSS 4.6EG 4.6
2021-01-29
Archer before 6.8 P2 (6.8.0.2) is affected by an open redirect vulnerability. A remote privileged attacker may potentially redirect legitimate users to arbitrary web sites and conduct phishing attacks. The attacker could then steal the vic…
CVE-2020-5337MEDIUMCVSS 4.6EG 4.6
2020-05-04
RSA Archer, versions prior to 6.7 P1 (6.7.0.1), contain a URL redirection vulnerability. A remote unauthenticated attacker could potentially exploit this vulnerability to redirect application users to arbitrary web URLs by tricking the vic…
CVE-2025-21401MEDIUMCVSS 4.5EG 4.5
2025-02-15
Microsoft Edge (Chromium-based) Security Feature Bypass Vulnerability
CVE-2023-3515MEDIUMCVSS 4.4EG 4.4
2023-07-05
Open Redirect in GitHub repository go-gitea/gitea prior to 1.19.4.
CVE-2021-25655MEDIUMCVSS 4.4EG 4.4
2021-06-24
A vulnerability in the system Service Menu component of Avaya Aura Experience Portal may allow URL Redirection to any untrusted site through a crafted attack. Affected versions include 7.0 through 7.2.3 (without hotfix) and 8.0.0 (without …
CVE-2020-26215MEDIUMCVSS 4.4EG 4.4
2020-11-18
Jupyter Notebook before version 6.1.5 has an Open redirect vulnerability. A maliciously crafted link to a notebook server could redirect the browser to a different website. All notebook servers are technically affected, however, these mali…
CVE-2026-101151MEDIUMCVSS 4.3EG 4.3
2026-10-06
Insufficient validation of request in login flow could allow a remote, unauthenticated attacker to craft a URL that, when clicked by a user, redirects the user's browser to an arbitrary external site upon completion of the authentication p…
CVE-2026-102090MEDIUMCVSS 4.3EG 4.3
2026-09-30
Kiteworks Core before version 9.5.1 is vulnerable to Content Injection. A URL parameter in the PDF viewer was insufficiently validated, allowing an attacker-controlled document to be loaded and displayed under the trust of the legitimate a…

Map vulnerabilities like CWE-601 to your infrastructure

EchelonGraph correlates every CVE — across CWE-601 and 150+ other weakness categories — against the assets you actually run. See blast radius, fix versions, and remediation steps in one graph.

Book a Demo →