CVE-2026-54770

Name of the Vulnerable Software and Affected Versions WebOb versions prior to 1.8.11

Description An issue exists where the Response. make location absolute() function in src/webob/response.py performs checks for a URI scheme or leading double slashes before urllib.parse.urljoin() removes leading C0 control characters and spaces. An attacker can provide a value, such as a space followed by a protocol-relative or absolute URL, to bypass SCHEME RE and startswith("..") checks, resulting in an off-host redirect. The Request.relative url() function and webob.exc. HTTPMove subclasses, including HTTPFound, are also affected due to unsafe URL joining behavior or bypassing the normalization path. An unauthenticated attacker capable of influencing a redirect target can redirect users to a malicious host for phishing or the theft of OAuth and SSO tokens, provided the user follows the redirect.

Recommendations Update to version 1.8.11.