{"apiVersion":"1.0","identifier":"CVE-2026-54770","description":"WebOb provides objects for HTTP requests and responses. Prior to 1.8.11, Response._make_location_absolute() in src/webob/response.py checks a Location value for a URI scheme or leading double slash before urllib.parse.urljoin() strips leading C0 control characters and spaces. An attacker-controlled value such as a space followed by a protocol-relative or absolute URL can therefore bypass SCHEME_RE and startswith(-//-) checks and be normalized to an off-host redirect. Request.relative_url() and webob.exc._HTTPMove subclasses, including HTTPFound, are also affected because they use the same unsafe URL joining behavior or bypass the earlier normalization path. An unauthenticated attacker who can influence an application-s redirect target can send users to an attacker-controlled host for phishing or OAuth and SSO token theft, but exploitation requires the user to follow the redirect. This issue is fixed in version 1.8.11.","publishedAt":"2026-08-20T17:18:18","lastModifiedAt":"2026-08-25T15:16:32","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-54770","cvssScore":6.1,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","epssProbability":0.00339,"riskScore":0.63,"affectedProduct":"WebOb","affectedVersions":"<1.8.11","vulnerabilityType":"Library","operatingSystems":[],"links":{"self":"https://www.redsauce.net/api/cves/CVE-2026-54770","webPages":{"es":"https://www.redsauce.net/es/cves/CVE-2026-54770","en":"https://www.redsauce.net/en/cves/CVE-2026-54770","fr":"https://www.redsauce.net/fr/cves/CVE-2026-54770","pt":"https://www.redsauce.net/pt/cves/CVE-2026-54770","de":"https://www.redsauce.net/de/cves/CVE-2026-54770","sk":"https://www.redsauce.net/sk/cves/CVE-2026-54770","el":"https://www.redsauce.net/el/cves/CVE-2026-54770"},"source":"https://nvd.nist.gov/vuln/detail/CVE-2026-54770"}}