URL Redirection Vulnerability in WebOb by Pylons
CVE-2026-54770

6.1MEDIUM

Key Information:

Vendor

Pylons

Status
Webob
Vendor
CVE Published:
20 August 2026

What is CVE-2026-54770?

WebOb, a library that provides objects for handling HTTP requests and responses, contains a vulnerability in its URL handling mechanism. Prior to version 1.8.11, the method Response._make_location_absolute() incorrectly processes Location values, allowing for malicious modifications. This can lead to off-host redirections without the required validation checks, enabling attackers to redirect victims to their own controlled sites, facilitating potential phishing attempts or unauthorized access to OAuth and SSO tokens. An attacker must entice a user to follow the crafted redirect for exploitation. The issue has been addressed in version 1.8.11.

Affected Version(s)

webob < 1.8.11

References

https://github.com/Pylons/webob/security/advisories/GHSA-...
x_refsource_CONFIRM
https://github.com/Pylons/webob/commit/ff89560643fb252751...
x_refsource_MISC
https://github.com/Pylons/webob/tree/1.8.11
x_refsource_MISC

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.