CVE-2026-44889
MediumCVSS 6.1Exploitation Probability (EPSS)
Low risk6th percentile — higher than 6% of all known CVEs
Summary
WebOb before version 1.8.10 is vulnerable to an open redirect due to improper normalization of the Location header during a redirect. An attacker can use ASCII tab, carriage return, and newline characters to reinterpret the target URL as a protocol-relative URL, leading to redirection to an external attacker-controlled site. This vulnerability bypasses the CVE-2024-42353 fix.
Risk Assessment
The organization is exposed to phishing attacks and credential theft, as an attacker can redirect users to fake sites impersonating trusted services.
Recommendation
Immediately update the WebOb library to version 1.8.10 or later, which contains the fix for this vulnerability.
Original NVD description (English source)
WebOb provides objects for HTTP requests and responses. Prior to 1.8.10, the normalization of the HTTP Location header during a redirect is vulnerable to an open redirect: WebOb joins the redirect target to the request URI using Python's urljoin, and since Python 3.10 the underlying urlsplit strips ASCII tab, carriage return, and newline characters before parsing, so a redirect target containing such characters can be reinterpreted as a protocol-relative URL whose authority is an attacker-controlled host. This bypasses the CVE-2024-42353 fix that escaped a leading double slash, allowing an attacker who influences the redirect location to send users to an arbitrary external site instead of the intended one. This vulnerability is fixed in 1.8.10.