CVE-2026-54770
Received Received - Intake

WebOb Location Header Redirect Bypass Vulnerability

Publication date: 2026-08-20

Last updated on: 2026-08-20

Assigner: GitHub, Inc.

Description
WebOb provides objects for HTTP requests and responses. Prior to 1.8.11, Response._make_location_absolute() in src/webob/response.py checks a Location value for a URI scheme or leading double slash before urllib.parse.urljoin() strips leading C0 control characters and spaces. An attacker-controlled value such as a space followed by a protocol-relative or absolute URL can therefore bypass SCHEME_RE and startswith("//") checks and be normalized to an off-host redirect. Request.relative_url() and webob.exc._HTTPMove subclasses, including HTTPFound, are also affected because they use the same unsafe URL joining behavior or bypass the earlier normalization path. An unauthenticated attacker who can influence an application's redirect target can send users to an attacker-controlled host for phishing or OAuth and SSO token theft, but exploitation requires the user to follow the redirect. This issue is fixed in version 1.8.11.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-20
Last Modified
2026-08-20
Generated
2026-08-20
AI Q&A
2026-08-20
EPSS Evaluated
N/A
NVD
CVE-2026-54770
EUVD
EUVD-2026-63467

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
python webob to 1.8.11 (inc)
pylons webob to 1.8.11 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-601 The web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a redirect.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in WebOb before 1.8.11 allows an attacker to manipulate redirect URLs by injecting leading spaces or control characters. The function Response._make_location_absolute() fails to properly sanitize these inputs before processing, enabling off-host redirects that bypass security checks. This can trick users into visiting malicious sites.

Detection Guidance

Check if your WebOb version is below 1.8.11 by running: pip show webob. If installed, verify the version in your environment. Inspect application code for use of Response._make_location_absolute(), HTTPFound, or similar redirect methods. Monitor HTTP responses for unusual redirects or off-host locations.

Impact Analysis

An attacker could use this flaw to redirect you to a fake website designed to steal credentials or session tokens. Since the redirect appears legitimate, you might unknowingly enter sensitive information. Exploitation requires you to follow the malicious link.

Compliance Impact

This vulnerability could indirectly impact compliance with GDPR and HIPAA by enabling phishing attacks or token theft through open redirects. If an attacker redirects users to malicious sites, it may lead to unauthorized data exposure or credential theft, violating data protection principles under GDPR and HIPAA.

Mitigation Strategies

Upgrade WebOb to version 1.8.11 or later immediately. Review and sanitize all user-controlled redirect targets in your application. Implement strict URL validation for redirect inputs to prevent off-host redirects.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-54770. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart