CVE-2026-49820
- Source
- https://cve.org/CVERecord?id=CVE-2026-49820
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-49820.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2026-49820
- Aliases
- Downstream
- Related
- Published
- 2026-08-13T14:36:34.645Z
- Modified
- 2026-08-16T03:31:28.256858939Z
- Severity
-
- 4.7 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N CVSS Calculator
- Summary
- Probo has an open redirect bypass via path normalization
- Details
-
Probo is a self-hostable governance, risk, and compliance (GRC) platform built for engineering and security teams. Probo's
saferedirectpackage validates redirect URLs used across authentication flows (OIDC, SAML, session transfer, OAuth connectors, and trust-center magic links). Prior to version 0.19.3.1, the validator only inspected the second character of relative paths, so a URL like/../\evil.compassed validation because the second character is.. Go'shttp.Redirectnormalizes this path to/\evil.combefore setting theLocationheader. Browsers can interpret the backslash as a host separator and redirect the user to an external domain (https://evil.com), bypassing the intended same-origin restriction. This enables open-redirect phishing: an attacker can craft acontinueparameter (or embed a malicious URL in a session-transfer token) that appears to originate from a trusted Probo domain but redirects victims elsewhere. This is fixed ingo.probo.inc/probo0.193.1 by normalizing relative paths withpath.Cleanbefore validation, rejecting backslashes (including percent-encoded%5c) anywhere in the path, and re-checking the normalized result for protocol-relative and backslash prefixes. Self-hosted deployments should upgrade to probod v0.194.1 or later. SaaS deployments on getprobo.com are patched. No practical workaround is available for self-hosted installations. - Database specific
{ "cna_assigner": "GitHub_M", "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/49xxx/CVE-2026-49820.json", "cwe_ids": [ "CWE-601" ] }- References