CVE-2026-55252

Name of the Vulnerable Software and Affected Versions openrun (affected versions not specified)

Description Restrictions on redirect URLs can be bypassed, leading to open redirect attacks. The issue occurs because the validation logic only verifies that the host and schema of the redirect URL match the current website, subsequently using only the path part for the redirection. An attacker can bypass this by providing a URL where the path begins with //, such as http://127.0.0.1:25222//fushuling.com. Browsers interpret paths starting with // as protocol-relative URLs, which redirects the user to an external domain. This is triggered via the Referer header.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.