GHSA-p44j-xrqg-4xrr URL Redirection to Untrusted Site ('Open Redirect') in Products.PluggableAuthService

• PyPI Products.PluggableAuthService: < 2.6.1 → fixed in 2.6.1

Impact _What kind of vulnerability is it? Who is impacted?_ Open redirect vulnerability - a maliciously crafted link to the login form and login functionality could redirect the browser to a different website. Patches _Has the problem been patched? What versions should users upgrade to?_ The problem has been fixed in version 2.6.1. Depending on how you have installed Products.PluggableAuthService, you should change the buildout version pin to `2.6.1` and re-run the buildout, or if you used `pip` simply do `pip install "Products.PluggableAuthService>=2.6.1"` Workarounds _Is there a way for users to fix or remediate the vulnerability without upgrading?_ There is no workaround. Users are encouraged to upgrade. References _Are there any links users can visit to find out more?_ • GHSA-p44j-xrqg-4xrr • Products.PluggableAuthService on PyPI • OWASP page on open redirects For more information If you have any questions or comments about this advisory: • Open an issue in the Products.PluggableAuthService issue tracker • Email us at [email protected]