CVE-2025-71405
MediumCVSS 5.1Exploitation Probability (EPSS)
Low risk23th percentile - higher than 23% of all known CVEs
Summary
chi versions before v5.2.2 contain an open redirect vulnerability in the RedirectSlashes middleware function that uses the Host header to construct redirect URLs. Attackers can manipulate the Host header to redirect users to arbitrary hosts, enabling phishing attacks and credential theft.
Risk Assessment
The risk includes credential theft and phishing, potentially leading to user security compromise and loss of trust in the application.
Recommendation
Update chi to version v5.2.2 or later and validate the Host header in server configuration.
Original NVD description (English source)
chi versions before v5.2.2 contain an open redirect vulnerability in the RedirectSlashes middleware function that uses the Host header to construct redirect URLs. Attackers can manipulate the Host header to redirect users to arbitrary hosts, enabling phishing attacks and credential theft.