CVE-2026-85676
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk16th percentile - higher than 16% of all known CVEs
Summary
Dub contains an open redirect vulnerability in the redir_url query parameter that is accepted on every short link without validation or domain allowlist enforcement. Attackers can append the redir_url parameter to any short link to redirect visitors to arbitrary external URLs through the trusted Dub domain, bypassing destination blacklists and potentially enabling phishing attacks with link cloaking enabled.
Risk Assessment
The risk for the organization includes the use of the trusted Dub domain for phishing, which could lead to credential theft or malware installation on end users.
Recommendation
It is recommended to immediately implement validation of the redir_url parameter, including a domain allowlist, and update to a version that fixes this vulnerability.
Other vulnerabilities in Dub
Original NVD description (English source)
Dub contains an open redirect vulnerability in the redir_url query parameter that is accepted on every short link without validation or domain allowlist enforcement. Attackers can append the redir_url parameter to any short link to redirect visitors to arbitrary external URLs through the trusted Dub domain, bypassing destination blacklists and potentially enabling phishing attacks with link cloaking enabled.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS