Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

github логотип

GHSA-r4cg-5xmx-26h7

Опубликовано: 07 нояб. 2025
Источник: github
Github: Не прошло ревью
CVSS3: 6.5

Описание

An Open Redirect vulnerability exists in the OAuth callback handler in file onlook/apps/web/client/src/app/auth/callback/route.ts in Onlook web application 0.2.32. The vulnerability occurs because the application trusts the X-Forwarded-Host header value without proper validation when constructing a redirect URL. A remote attacker can send a manipulated X-Forwarded-Host header to redirect an authenticated user to an arbitrary external website under their control, which can be exploited for phishing attacks.

An Open Redirect vulnerability exists in the OAuth callback handler in file onlook/apps/web/client/src/app/auth/callback/route.ts in Onlook web application 0.2.32. The vulnerability occurs because the application trusts the X-Forwarded-Host header value without proper validation when constructing a redirect URL. A remote attacker can send a manipulated X-Forwarded-Host header to redirect an authenticated user to an arbitrary external website under their control, which can be exploited for phishing attacks.

EPSS

Процентиль: 37%
0.0016
Низкий

6.5 Medium

CVSS3

Дефекты

CWE-601

Связанные уязвимости

CVSS3: 6.5
nvd
3 месяца назад

An Open Redirect vulnerability exists in the OAuth callback handler in file onlook/apps/web/client/src/app/auth/callback/route.ts in Onlook web application 0.2.32. The vulnerability occurs because the application trusts the X-Forwarded-Host header value without proper validation when constructing a redirect URL. A remote attacker can send a manipulated X-Forwarded-Host header to redirect an authenticated user to an arbitrary external website under their control, which can be exploited for phishing attacks.

EPSS

Процентиль: 37%
0.0016
Низкий

6.5 Medium

CVSS3

Дефекты

CWE-601