CVE-2026-64941
Received Received - Intake

Open Redirect in Phoenix LiveView

Publication date: 2026-08-10

Last updated on: 2026-08-10

Assigner: EEF

Description
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in phoenixframework phoenix_live_view allows an attacker to send a victim's browser to an origin of the attacker's choosing via a :to value containing ASCII tab, LF or CR. redirect/2 validates :to through the private validate_local_url!/2 in lib/phoenix_live_view.ex, which is intended to guarantee the target is a path within the application. It rejects a leading // and any backslash, but not ASCII tab, LF or CR. Browsers strip those three characters before parsing a URL, so a value such as /<TAB>/example.com passes validation as a path and is then resolved as the scheme-relative URL //example.com. The live navigation functions share the guard but are not affected, because the client expands their target against the current origin. push_patch/2 is also affected before 0.7.0, which is when that expansion was added. This issue affects phoenix_live_view: from 0.5.0 before 1.0.19, from 1.1.0-rc.0 before 1.1.33, and from 1.2.0-rc.0 before 1.2.9.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-10
Last Modified
2026-08-10
Generated
2026-08-10
AI Q&A
2026-08-10
EPSS Evaluated
N/A
NVD
CVE-2026-64941
EUVD
EUVD-2026-55263

Affected Vendors & Products

Showing 4 associated CPEs
Vendor Product Version / Range
phoenixframework phoenix_live_view From 0.5.0 (inc) to 1.0.19 (exc)
phoenixframework phoenix_live_view From 1.1.0-rc.0 (inc) to 1.1.33 (exc)
phoenixframework phoenix_live_view From 1.2.0-rc.0 (inc) to 1.2.9 (exc)
phoenixframework phoenix_live_view to 0.7.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-601 The web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a redirect.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is an open redirect vulnerability in Phoenix.LiveView's redirect/2 function. It fails to block ASCII tab, line feed, or carriage return characters in URLs. Attackers can insert these characters to bypass validation, tricking browsers into redirecting to malicious external sites.

Detection Guidance

Check Phoenix LiveView application logs for suspicious redirect attempts containing ASCII tab, LF, or CR characters in URLs. Inspect network traffic for redirects to external domains from your application. Use tools like curl to test if your application accepts crafted URLs like /<TAB>/example.com.

Impact Analysis

An attacker could send you a crafted link that appears to stay on a trusted domain but actually redirects to a malicious site. This could lead to phishing attacks, theft of session tokens, or exposure of sensitive data in URLs.

Mitigation Strategies

Upgrade Phoenix LiveView to patched versions (1.0.19, 1.1.33, or 1.2.9). Validate all user-supplied input for redirect functions to reject URLs containing ASCII tab, LF, or CR. Avoid passing untrusted parameters directly to redirect/2 or push_patch/2.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-64941. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart