GitHub Advisoryadvisory · PyPI

GHSA-rf8c-3f5p-xv45 web2py has an Open Redirect Vulnerability

MEDIUM Published 2026-02-05 Modified 2026-02-05 Official page ↗
Aliases
CVE-2026-25198
Ecosystem
PyPI
Packages
web2py
Severity
Moderate
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N
Weaknesses
CWE-601
Reviewed
2026-02-05

Affected packages

• PyPI web2py: < 3.1.1 → fixed in 3.1.1

Description

web2py versions 2.27.1-stable+timestamp.2023.11.16.08.03.57 and prior contain an Open Redirect vulnerability. If this vulnerability is exploited, the user may be redirected to an arbitrary website when accessing a specially crafted URL. As a result, the user may become a victim of a phishing attack.

Related

Alias · CVE (1)

  • CVE-2026-25198 web2py versions 2.27.1-stable+timestamp.2023.11.16.08.03.57 and prior contain an open redirect vulnerability. vulnerability

Weakness · CWE (1)

  • CWE-601 URL Redirection to Untrusted Site weakness

References