GHSA-vfm5-cr22-jg3m

Source

https://github.com/advisories/GHSA-vfm5-cr22-jg3m

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/12/GHSA-vfm5-cr22-jg3m/GHSA-vfm5-cr22-jg3m.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-vfm5-cr22-jg3m

Aliases

CVE-2025-65581

Published

2025-12-16T18:31:35Z

Modified

2025-12-16T23:26:15.678618Z

Severity

5.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CVSS Calculator

Summary

ABP Account Module has an Open Redirect through Improper validation in its register function

Details

An open redirect vulnerability exists in the Account module in Volosoft ABP Framework >= 5.1.0 and < 10.0.0-rc.2. Improper validation of the returnUrl parameter in the register function allows an attacker to redirect users to arbitrary external domains.

Database specific

{
    "github_reviewed_at": "2025-12-16T23:12:33Z",
    "cwe_ids": [
        "CWE-20",
        "CWE-601"
    ],
    "severity": "MODERATE",
    "github_reviewed": true,
    "nvd_published_at": "2025-12-16T18:16:14Z"
}

References

Affected packages

NuGet / Volo.Abp.Account.Web

Package

Name: Volo.Abp.Account.Web; View open source insights on deps.dev
Purl: pkg:nuget/Volo.Abp.Account.Web

Affected ranges

Type: ECOSYSTEM
Events: Introduced

5.1.0

Fixed

10.0.0-rc.2

Affected versions

5.*

5.1.0

5.1.1

5.1.2

5.1.3

5.1.4

5.2.0

5.2.1

5.2.2

5.3.0

5.3.1

5.3.2

5.3.3

5.3.4

5.3.5

6.*

6.0.0

6.0.1

6.0.2

6.0.3

7.*

7.0.0

7.0.1

7.0.2

7.0.3

7.1.0

7.1.1

7.2.1

7.2.2

7.2.3

7.3.0

7.3.1

7.3.2

7.3.3

7.4.0

7.4.1

7.4.2

7.4.3

7.4.4

7.4.5

8.*

8.0.0

8.0.1

8.0.2

8.0.3

8.0.4

8.0.5

8.0.6

8.1.0

8.1.1

8.1.2

8.1.3

8.1.4

8.1.5

8.2.0

8.2.1

8.2.2

8.2.3

8.3.0

8.3.1

8.3.2

8.3.3

8.3.4

9.*

9.0.0

9.0.1

9.0.2

9.0.3

9.0.4

9.0.5

9.0.6

9.0.7

9.0.8

9.1.0

9.1.1

9.1.2

9.1.3

9.2.0

9.2.1

9.2.2

9.2.3

9.2.4

9.3.0

9.3.1

9.3.2

9.3.3

9.3.4

9.3.5

9.3.6

9.3.7