PYSEC-2026-3413
See a problem?- Import Source
- https://github.com/pypa/advisory-database/blob/main/vulns/web2py/PYSEC-2026-3413.yaml
- JSON Data
- https://api.osv.dev/v1/vulns/PYSEC-2026-3413
- Aliases
- Published
- 2026-07-13T14:36:34.584653Z
- Modified
- 2026-07-13T16:33:27.692399683Z
- Severity
-
- 4.7 (Medium) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N CVSS Calculator
- 5.1 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N CVSS Calculator
- Summary
- web2py has an Open Redirect Vulnerability
- Details
-
web2py versions 2.27.1-stable+timestamp.2023.11.16.08.03.57 and prior contain an Open Redirect vulnerability. If this vulnerability is exploited, the user may be redirected to an arbitrary website when accessing a specially crafted URL. As a result, the user may become a victim of a phishing attack.
- References
-
- https://nvd.nist.gov/vuln/detail/CVE-2026-25198
- https://github.com/web2py/web2py/commit/b4e1ddbd6d40fb30863f6263a67bcdf411a0c6df
- https://github.com/web2py/web2py
- https://github.com/web2py/web2py/releases
- https://jvn.jp/en/jp/JVN46925341
- https://web2py.com
- https://pypi.org/project/web2py
- https://github.com/advisories/GHSA-rf8c-3f5p-xv45
Affected packages
PyPI / web2py
Package
- Name
- web2py
- View open source insights on deps.dev
- Purl
- pkg:pypi/web2py