CVE-2026-114060

SvelteKit @sveltejs/kit before 3.0.0 contains an open redirect vulnerability in enhanced form actions use:enhance on routes accepting paths beginning with a double slash. Attackers can craft action paths starting with // that become protocol-relative URLs, causing non-redirect form results to...

CVE-2026-114060

SvelteKit (@sveltejs/kit ) versions before 3.0.0 are vulnerable to an open redirect vulnerability within the enhanced form actions (use:enhance). The issue occurs on routes that accept paths starting with a double slash (//). Attackers can craft action paths starting with // to create protocol-re...

CVE-2026-114060

SvelteKit @sveltejs/kit before 3.0.0 contains an open redirect vulnerability in enhanced form actions use:enhance on routes accepting paths beginning with a double slash. Attackers can craft action paths starting with // that become protocol-relative URLs, causing non-redirect form results to...

EUVD-2026-107011

SvelteKit @sveltejs/kit before 3.0.0 contains an open redirect vulnerability in enhanced form actions use:enhance on routes accepting paths beginning with a double slash. Attackers can craft action paths starting with // that become protocol-relative URLs, causing non-redirect form results to...

CVE-2026-114060 SvelteKit before 3.0.0 Open Redirect via Enhanced Form Actions

SvelteKit @sveltejs/kit before 3.0.0 contains an open redirect vulnerability in enhanced form actions use:enhance on routes accepting paths beginning with a double slash. Attackers can craft action paths starting with // that become protocol-relative URLs, causing non-redirect form results to...

PT-2026-120186

SvelteKit @sveltejs/kit before 3.0.0 contains an open redirect vulnerability in enhanced form actions use:enhance on routes accepting paths beginning with a double slash. Attackers can craft action paths starting with // that become protocol-relative URLs, causing non-redirect form results to...