Open Redirect Vulnerability in WebOb by Pylons
CVE-2026-44889

6.1MEDIUM

Key Information:

Vendor

Pylons

Status
Webob
Vendor
CVE Published:
22 June 2026

What is CVE-2026-44889?

The open redirect vulnerability in WebOb, affecting versions prior to 1.8.10, allows an attacker to influence the HTTP Location header during a redirect, potentially redirecting users to unauthorized external sites. This occurs due to improper normalization of the redirect target, which can include ASCII tab, carriage return, and newline characters, leading to misinterpretation as a protocol-relative URL. The flaw circumvents previous security measures, enabling potential malicious redirection to an attacker-controlled host.

Affected Version(s)

webob < 1.8.10

References

https://github.com/Pylons/webob/security/advisories/GHSA-...
x_refsource_CONFIRM

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.