CVE-2026-64941

Name of the Vulnerable Software and Affected Versions phoenix live view versions 0.5.0 through 1.0.18 phoenix live view versions 1.1.0-rc.0 through 1.1.32 phoenix live view versions 1.2.0-rc.0 through 1.2.8

Description An Open Redirect issue exists where an attacker can redirect a victim's browser to an arbitrary origin. This occurs because the redirect/2 function uses validate local url!/2 to ensure the target is a local path, but it fails to reject ASCII tab, LF, or CR characters. Since browsers strip these characters before parsing the URL, a value like /<TAB>/example.com bypasses validation and is interpreted as a scheme-relative URL. The push patch/2 function is also affected in versions prior to 0.7.0. The issue is triggered when the application passes an externally influenced value as the :to parameter, such as a return to parameter during sign-in or a navigation target from a handle event/3 payload.

Recommendations Update phoenix live view to version 1.0.19 or later. Update phoenix live view to version 1.1.33 or later. Update phoenix live view to version 1.2.9 or later. Reject any untrusted value containing ASCII tab, LF, or CR before passing it as the :to parameter to redirect/2 or push patch/2 (for versions prior to 0.7.0). Map client-supplied navigation targets to a fixed set of known-good paths instead of forwarding the value directly.