CVE-2026-44889

Name of the Vulnerable Software and Affected Versions WebOb versions prior to 1.8.10

Description An open redirect occurs when the software normalizes the HTTP Location header to include the request hostname. The process involves parsing the redirect URL using Python's urllib.parse and joining it to the base URL. Because urlsplit (called internally by urljoin) treats a // at the start of a string as a URI without a scheme, it interprets the subsequent part as the hostname, replacing the original request hostname.

Although a previous attempt was made to mitigate this by replacing // with /%2f, Python 3.10 and later versions of urlsplit internally strip ASCII tab, carriage return, and newline characters. Consequently, a string such as /t/attacker.com is converted to //attacker.com, bypassing the previous fix and allowing redirection to an external domain.

Recommendations Update to version 1.8.10. As a temporary workaround, rewrite any use of the Response class that includes a location to ensure a full URI including the hostname is passed, or validate that the redirect target starts with a scheme such as http:// or https:// before assigning it to Response.location.