DEV Community

CVE Reports
CVE Reports

Posted on Originally published at cvereports.com

CVE-2026-54770: CVE-2026-54770: Open Redirect via Parser Differential in WebOb

#security #cve #cybersecurity

CVE-2026-54770: Open Redirect via Parser Differential in WebOb

Vulnerability ID: CVE-2026-54770
CVSS Score: 6.1
Published: 2026-08-27

An open redirect vulnerability exists in WebOb before version 1.8.11 due to a parser differential between WebOb's validation logic and Python's standard urllib.parse.urljoin() function. Under Python 3.10+, the urljoin function strips leading and trailing space characters and C0 control characters, which allowed specially crafted inputs to bypass WebOb's prefix checks while still resolving as off-host redirects.

TL;DR

A parser differential between WebOb and Python's urljoin on modern runtimes allows unauthenticated attackers to bypass open redirect protections using leading spaces or control characters.

⚠️ Exploit Status: POC

Technical Details

  • CWE ID: CWE-601
  • Attack Vector: Network
  • CVSS v3.1: 6.1 (Medium)
  • EPSS Score: 0.00339 (0.34%)
  • Exploit Status: Proof-of-Concept
  • KEV Status: Not Listed
  • Impact: Open Redirect / Phishing

Affected Systems

  • WebOb on Python 3.10+
  • WebOb: < 1.8.11 (Fixed in: 1.8.11)

Code Analysis

Commit: ff89560

Fix open redirect vulnerability by implementing custom RFC 3986 urljoin and consolidating exceptions to use safe normalization.

Mitigation Strategies

  • Upgrade the WebOb library to version 1.8.11 or later.
  • Implement application-layer validation to reject redirection inputs containing leading whitespace or control characters.
  • Deploy Web Application Firewall (WAF) filters to intercept and block anomalous redirection headers.

Remediation Steps:

  1. Execute pip install --upgrade webob to pull the latest security release.
  2. Confirm requirements.txt or pipfile contains strict pinning of webob>=1.8.11.
  3. Verify redirection flows within legacy application code to ensure all redirect functions utilize the standardized validation paths.

References

Read the full report for CVE-2026-54770 on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)