What is GHSA-rf8c-3f5p-xv45?

GHSA-rf8c-3f5p-xv45 is a security advisory published by GitHub Security Advisories with Medium severity. web2py has an Open Redirect Vulnerability

Which CVE IDs does GHSA-rf8c-3f5p-xv45 cover?

GHSA-rf8c-3f5p-xv45 covers the following CVE IDs: CVE-2026-25198. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-rf8c-3f5p-xv45?

GHSA-rf8c-3f5p-xv45 has a CVSS v3 base score of 4.7, published by GitHub Security Advisories.

Which products are affected by GHSA-rf8c-3f5p-xv45?

GHSA-rf8c-3f5p-xv45 affects 1 product, including: pip/web2py:\u003c 3.1.1.

GHSA-rf8c-3f5p-xv45MediumCVSS 4.7

web2py has an Open Redirect Vulnerability

Vendor

GitHub Security Advisories

Published

February 5, 2026

Last Modified

February 5, 2026

🔗 CVE IDs covered (1)

CVE-2026-25198 →

📋 Description

web2py versions 2.27.1-stable+timestamp.2023.11.16.08.03.57 and prior contain an Open Redirect vulnerability. If this vulnerability is exploited, the user may be redirected to an arbitrary website when accessing a specially crafted URL. As a result, the user may become a victim of a phishing attack.

🎯 Affected products1

pip/web2py:< 3.1.1

🔗 References (6)

https://nvd.nist.gov/vuln/detail/CVE-2026-25198
https://github.com/web2py/web2py/commit/b4e1ddbd6d40fb30863f6263a67bcdf411a0c6df
https://github.com/web2py/web2py/releases
https://jvn.jp/en/jp/JVN46925341
https://web2py.com
https://github.com/advisories/GHSA-rf8c-3f5p-xv45