CVE-2026-49820
Received Received - Intake

Open Redirect Vulnerability in Probo's saferedirect Package

Publication date: 2026-08-13

Last updated on: 2026-08-13

Assigner: GitHub, Inc.

Description
Probo is a self-hostable governance, risk, and compliance (GRC) platform built for engineering and security teams. Probo's `saferedirect` package validates redirect URLs used across authentication flows (OIDC, SAML, session transfer, OAuth connectors, and trust-center magic links). Prior to version 0.19.3.1, the validator only inspected the second character of relative paths, so a URL like `/../\evil.com` passed validation because the second character is `.`. Go's `http.Redirect` normalizes this path to `/\evil.com` before setting the `Location` header. Browsers can interpret the backslash as a host separator and redirect the user to an external domain (`https://evil.com`), bypassing the intended same-origin restriction. This enables open-redirect phishing: an attacker can craft a `continue` parameter (or embed a malicious URL in a session-transfer token) that appears to originate from a trusted Probo domain but redirects victims elsewhere. This is fixed in `go.probo.inc/probo` 0.193.1 by normalizing relative paths with `path.Clean` before validation, rejecting backslashes (including percent-encoded `%5c`) anywhere in the path, and re-checking the normalized result for protocol-relative and backslash prefixes. Self-hosted deployments should upgrade to probod v0.194.1 or later. SaaS deployments on getprobo.com are patched. No practical workaround is available for self-hosted installations.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-13
Last Modified
2026-08-13
Generated
2026-08-13
AI Q&A
2026-08-13
EPSS Evaluated
N/A
NVD
CVE-2026-49820
EUVD
EUVD-2026-58095

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
probo saferedirect to 0.193.1 (exc)
probo probo 0.193.1
probo probo From 0.194.1 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-601 The web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a redirect.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is an open redirect vulnerability in Probo's saferedirect package. It occurs because the validator only checked the second character of relative paths, allowing malicious URLs like /../\evil.com to pass validation. Go's http.Redirect normalizes this to /\evil.com, and browsers may interpret the backslash as a host separator, redirecting users to an external domain.

Detection Guidance

To detect this vulnerability, inspect Probo's saferedirect package version. Check if your system uses versions prior to 0.193.1. Review redirect URLs in logs for patterns like /../\evil.com or paths containing backslashes or percent-encoded %5c. Test redirects by crafting URLs with these patterns to see if they bypass validation.

Impact Analysis

An attacker could craft a malicious URL that appears to come from a trusted Probo domain but redirects victims to an untrusted site. This enables phishing attacks where users may unknowingly enter credentials or sensitive data on a fake site.

Mitigation Strategies

Immediately upgrade Probo to version 0.194.1 or later. For self-hosted deployments, update the probod package. SaaS users on getprobo.com are already patched. No workarounds exist for self-hosted systems other than upgrading.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-49820. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart