CVE-2026-54770
MediumCVSS 6.1Exploitation Probability (EPSS)
Low risk26th percentile - higher than 26% of all known CVEs
Summary
WebOb provides objects for HTTP requests and responses. Prior to 1.8.11, Response._make_location_absolute() in src/webob/response.py checks a Location value for a URI scheme or leading double slash before urllib.parse.urljoin() strips leading C0 control characters and spaces. An attacker-controlled value such as a space followed by a protocol-relative or absolute URL can therefore bypass SCHEME_RE and startswith("//") checks and be normalized to an off-host redirect. Request.relative_url() and webob.exc._HTTPMove subclasses, including HTTPFound, are also affected because they use the same unsafe URL joining behavior or bypass the earlier normalization path. An unauthenticated attacker who can influence an application's redirect target can send users to an attacker-controlled host for phishing or OAuth and SSO token theft, but exploitation requires the user to follow the redirect. This issue is fixed in version 1.8.11.
Risk Assessment
The risk includes redirecting users to malicious sites, potentially leading to phishing, credential theft, or session token theft. The attack requires the application to use WebOb for redirect handling and the attacker to influence the Location value.
Recommendation
It is recommended to immediately upgrade to version 1.8.11 or later. Also, avoid passing unsanitized data to the Location header and apply additional URL validation.
Related vulnerabilities
- CVE-2026-78657Critical
The SigmaForms Pro – AI Generated Forms plugin for WordPress up to version 1.4.11 is vulnerable to arbitrary file deletion due to insufficient file path validation in the delete_submission_files function. Unauthenticated attackers can delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). The malicious path traversal URL is submitted via form upload field and stored in the database, with deletion triggered when an administrator deletes the submission record from the admin panel.
- CVE-2026-9055Critical
The Booking for Appointments and Events Calendar – Amelia (Premium) plugin for WordPress versions 8.0 - 9.6.2 is vulnerable to privilege escalation due to insufficient validation of the 'type' parameter in the customer update endpoint. This allows customers to set their role to 'manager' and trigger creation of a WordPress user with the wpamelia-manager role when 'externalId' is set to 0. Unauthenticated attackers can escalate to administrator by first elevating to manager, then creating a provider entity linked to an administrator user ID and overwriting that administrator's password.
- CVE-2026-84699Critical
Team Password Manager before version 14.184.308 fails to enforce authentication requirements in the local account password reset flow. Unauthenticated attackers can reset local account passwords and authenticate as those users to gain unauthorized access.
- CVE-2026-84354Critical
Incorrect authorization in FileSystem in Google Chrome prior to 152.0.7977.75 allowed a remote attacker leveraging social engineering to execute arbitrary code outside the sandbox via a crafted HTML page. (Severity: High)
- CVE-2026-84353Critical
Use after free in Shared Tab Groups in Google Chrome on Android prior to 152.0.7977.75 allowed a remote attacker leveraging social engineering to execute arbitrary code outside the sandbox via a crafted HTML page. (Severity: Critical)
- CVE-2026-84352Critical
Use after free in WebGL in Google Chrome on Android prior to 152.0.7977.75 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Severity: Critical)
- CVE-2026-84333Critical
Use-after-free in Dawn in Google Chrome on Android prior to 152.0.7977.75. A remote attacker could execute arbitrary code outside the sandbox via a crafted HTML page.
- CVE-2026-84324Critical
Use after free in Proxy in Google Chrome prior to 152.0.7977.75 allowed a remote attacker to execute arbitrary code outside the sandbox via crafted network traffic. (Chromium security severity: High)
- CVE-2026-84480Critical
WWBN AVideo fails to validate password recovery token expiration in userRecoverPassSave.json.php, allowing attackers to use expired tokens to reset account passwords indefinitely. Attackers who obtain a recovery token can use it at any time to change the target account's password and gain full account access.
- CVE-2026-84479Critical
WWBN AVideo (current e01e41ecc and earlier) makes three login-time security controls depend solely on the client-supplied User-Agent header. The isAVideoEncoder()/isAVideoMobileApp() checks match HTTP_USER_AGENT against a hardcoded literal ("AVideoEncoder"/"AVideoMobileApp") with no IP check or shared secret. An attacker who submits valid credentials and sets User-Agent: AVideoEncoder bypasses two-factor authentication, skips brute-force captcha escalation, and avoids being recorded in the login/device audit history. No patch is available at the time of publication.
Original NVD description (English source)
WebOb provides objects for HTTP requests and responses. Prior to 1.8.11, Response._make_location_absolute() in src/webob/response.py checks a Location value for a URI scheme or leading double slash before urllib.parse.urljoin() strips leading C0 control characters and spaces. An attacker-controlled value such as a space followed by a protocol-relative or absolute URL can therefore bypass SCHEME_RE and startswith("//") checks and be normalized to an off-host redirect. Request.relative_url() and webob.exc._HTTPMove subclasses, including HTTPFound, are also affected because they use the same unsafe URL joining behavior or bypass the earlier normalization path. An unauthenticated attacker who can influence an application's redirect target can send users to an attacker-controlled host for phishing or OAuth and SSO token theft, but exploitation requires the user to follow the redirect. This issue is fixed in version 1.8.11.