GitHub Advisoryadvisory · NuGet

GHSA-vfm5-cr22-jg3m ABP Account Module has an Open Redirect through Improper validation in its register function

MEDIUM Published 2025-12-16 Modified 2025-12-16 Official page ↗
Aliases
CVE-2025-65581
Ecosystem
NuGet
Packages
Volo.Abp.Account.Web
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Weaknesses
CWE-20, CWE-601
Reviewed
2025-12-16

Affected packages

• NuGet Volo.Abp.Account.Web: >= 5.1.0, < 10.0.0-rc.2 → fixed in 10.0.0-rc.2

Description

An open redirect vulnerability exists in the Account module in Volosoft ABP Framework >= 5.1.0 and < 10.0.0-rc.2. Improper validation of the returnUrl parameter in the register function allows an attacker to redirect users to arbitrary external domains.

Related

Alias · CVE (1)

  • CVE-2025-65581 An open redirect vulnerability exists in the Account module in Volosoft ABP Framework >= 5.1.0 and < 10.0.0-rc.2. vulnerability

Weakness · CWE (2)

  • CWE-20 Improper Input Validation weakness
  • CWE-601 URL Redirection to Untrusted Site weakness

References