Tornado: Open redirect in RedirectHandler via protocol-relative URLs

Summary tornado.web.RedirectHandler builds its target URL by substituting parts of the request path into a template. Depending on where those substitutions appear in the template, an attacker can craft a request that redirects to a host of their choosing. This creates an open redirect on the...

GHSA-PW9P-V7R6-GX4P Tornado: Open redirect in RedirectHandler via protocol-relative URLs

Summary tornado.web.RedirectHandler builds its target URL by substituting parts of the request path into a template. Depending on where those substitutions appear in the template, an attacker can craft a request that redirects to a host of their choosing. This creates an open redirect on the...

CVE-2026-116578 Tornado: Open redirect in RedirectHandler via protocol-relative URLs

Tornado is a Python web framework and asynchronous networking library. Prior to 6.6, tornado.web.RedirectHandler URL templates can place regex-capture substitutions where crafted request paths change the redirect scheme or network location. Affected placements include substitutions at the start o...

CVE-2026-116578 Tornado: Open redirect in RedirectHandler via protocol-relative URLs

Tornado is a Python web framework and asynchronous networking library. Prior to 6.6, tornado.web.RedirectHandler URL templates can place regex-capture substitutions where crafted request paths change the redirect scheme or network location. Affected placements include substitutions at the start o...

CVE-2026-116578

The Tornado Python web framework and asynchronous networking library (versions prior to 6.6 ) is vulnerable to an open redirect in tornado.web.RedirectHandler. The root cause is that URL templates allow regex-capture substitutions in positions where crafted request paths can modify the redirect s...

EUVD-2026-107011

SvelteKit: URL redirection to untrusted site via enhanced form submission...

CVE-2026-115730

A flaw was found in i18next-http-backend. A remote attacker who can control namespace values can supply input starting with a slash to construct protocol-relative URLs in path templates. This flaw allows translation requests to be redirected to an attacker-controlled server, leading to cross-site...

Open Redirect

Overview @sveltejs/kit is a SvelteKit framework and CLI Affected versions of this package are vulnerable to Open Redirect via enhanced form actions use:enhance when handling routes that accept paths beginning with //, such as catch-all routes. An attacker can craft action paths starting with //...

CVE-2026-114060 SvelteKit before 3.0.0 Open Redirect via Enhanced Form Actions

SvelteKit @sveltejs/kit before 3.0.0 contains an open redirect vulnerability in enhanced form actions use:enhance on routes accepting paths beginning with a double slash. Attackers can craft action paths starting with // that become protocol-relative URLs, causing non-redirect form results to...

CVE-2026-114060

SvelteKit (@sveltejs/kit ) versions before 3.0.0 are vulnerable to an open redirect vulnerability within the enhanced form actions (use:enhance). The issue occurs on routes that accept paths starting with a double slash (//). Attackers can craft action paths starting with // to create protocol-re...

CVE-2026-114060 SvelteKit before 3.0.0 Open Redirect via Enhanced Form Actions

SvelteKit @sveltejs/kit before 3.0.0 contains an open redirect vulnerability in enhanced form actions use:enhance on routes accepting paths beginning with a double slash. Attackers can craft action paths starting with // that become protocol-relative URLs, causing non-redirect form results to...

CVE-2026-114060 SvelteKit before 3.0.0 Open Redirect via Enhanced Form Actions

SvelteKit @sveltejs/kit before 3.0.0 contains an open redirect vulnerability in enhanced form actions use:enhance on routes accepting paths beginning with a double slash. Attackers can craft action paths starting with // that become protocol-relative URLs, causing non-redirect form results to...

PT-2026-120186

Name of the Vulnerable Software and Affected Versions SvelteKit @sveltejs/kit versions prior to 3.0.0 Description An open redirect issue exists in enhanced form actions use:enhance on routes that accept paths starting with a double slash. Attackers can create action paths beginning with // that...

@angular/platform-server: Open Redirect via Protocol-Relative URLs in Server-Side Rendering (SSR)

An open redirect vulnerability was identified in @angular/platform-server when Server-Side Rendering SSR is enabled. When Angular SSR renders an incoming request, URL resolution and platform navigation are managed by ServerPlatformLocation using resolveUrl or parseUrl in v20. While resolveUrl...

WS-2026-0105

@angular/platform-server 17.0.0-rc.1 before 20.3.33, 21.2.25 and 22.2.1: ServerPlatformLocation rejects protocol-relative URLs before WHATWG URL normalization, so a path such as /.//evil.test normalizes to //evil.test and Angular SSR emits it in a Location header, an open redirect. Lines 17-19 ar...

CVE-2026-86351

Affected versions of MISP validate the user-configurable homepage by checking only whether the supplied path begins with /. That check is insufficient because protocol-relative URLs such as //attacker.example also begin with / but resolve to an external origin in browsers. The vulnerable homepage...

PT-2026-83447

Name of the Vulnerable Software and Affected Versions Rodauth versions prior to 2.47.0 Description Insufficient validation of protocol-relative return-to paths occurs within the confirm password, login return to requested location, and two factor auth return to requested location features. This...

CVE-2026-82467: URL Redirection to Untrusted Site

Rodauth before 2.47.0 fails to validate protocol-relative return-to paths in confirmpassword, loginreturntorequestedlocation, and twofactorauthreturntorequestedlocation features. Attackers can craft paths with leading double slashes that browsers resolve as protocol-relative URLs, redirecting...

Security Bulletin: IBM Storage Protect for Space Management is vulnerable to cross-site request forgery token leakage due to Angular (CVE-2025-66035)

Summary IBM Storage Protect for Space Management uses Angular to provide web-based user interface components. A vulnerability in Angular's HttpClient could allow the leakage of Cross-Site Request Forgery XSRF tokens when protocol-relative URLs are used, potentially exposing the token to an...

Security Bulletin: IBM Storage Protect Client is vulnerable to cross-site request forgery token leakage due to Angular (CVE-2025-66035)

Summary IBM Storage Protect Client uses Angular to provide web-based user interface components. A vulnerability in Angular's HttpClient could allow the leakage of Cross-Site Request Forgery XSRF tokens when protocol-relative URLs are used, potentially exposing the token to an attacker-controlled...