Open Redirect Vulnerability in Phoenix Framework's Phoenix Live View
CVE-2026-64941

2.1LOW

Key Information:

Vendor

Phoenixframework

Status
Phoenix Live View
Vendor
CVE Published:
10 August 2026

What is CVE-2026-64941?

The Phoenix Framework's Phoenix Live View has a vulnerability that allows an attacker to manipulate URL redirection, enabling them to redirect users to untrusted external sites. This vulnerability occurs due to insufficient validation of the ':to' values, specifically allowing ASCII tab, line feed (LF), or carriage return (CR) characters. As a result, a malicious actor could exploit this flaw by crafting a URL that seems legitimate within the application but ultimately leads to an attacker's specified origin. This issue is present in several versions and can affect user trust and security if not promptly addressed.

Affected Version(s)

phoenix_live_view 0.5.0 < 1.0.19

phoenix_live_view 1.1.0-rc.0 < 1.1.33

phoenix_live_view 1.2.0-rc.0 < 1.2.9

References

https://github.com/phoenixframework/phoenix_live_view/sec...
vendor-advisoryrelated
https://cna.erlef.org/cves/CVE-2026-64941.html
related
https://osv.dev/vulnerability/EEF-CVE-2026-64941
related

CVSS V4

Score:
2.1
Severity:
LOW
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Eurico Nicacio
Steffen Deusch
José Valim
Jonatan Männchen / EEF
.