CVE-2025-63784

MediumCVSS 6.5

Published: 07/11/2025(UTC)Updated: 05/11/2026(UTC)Translated: 05/11/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.45%

39th percentile - higher than 39% of all known CVEs

Summary

An Open Redirect vulnerability exists in the OAuth callback handler in onlook/apps/web/client/src/app/auth/callback/route.ts in Onlook web application 0.2.32. The application trusts the X-Forwarded-Host header without proper validation when constructing a redirect URL, allowing a remote attacker to redirect an authenticated user to an arbitrary external website.

Risk Assessment

An attacker could redirect an authenticated user to a site under their control, which can be exploited for phishing attacks and credential theft.

Recommendation

Update Onlook to a version later than 0.2.32 if a patch is available. Until then, review the validation of the X-Forwarded-Host header in the OAuth callback handler.

Other vulnerabilities in Onlook

CVE-2026-65013High
Onlook up to version 0.2.32 contains a Broken Object Level Authorization (BOLA) vulnerability that allows authenticated attackers to access and manipulate other users' resources by supplying arbitrary UUID values in tRPC API procedures. Attackers can read, modify, and delete other users' projects, members, and conversation history.

Original NVD description (English source)

An Open Redirect vulnerability exists in the OAuth callback handler in file onlook/apps/web/client/src/app/auth/callback/route.ts in Onlook web application 0.2.32. The vulnerability occurs because the application trusts the X-Forwarded-Host header value without proper validation when constructing a redirect URL. A remote attacker can send a manipulated X-Forwarded-Host header to redirect an authenticated user to an arbitrary external website under their control, which can be exploited for phishing attacks.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS