CVE-2025-63784

Katalog CVE

CVSS 6.5 · Medium EPSS 0,45%

Kerentanan URL Redirection to Untrusted Site ('Open Redirect') pada onlook. Skor CVSS 3.1 6.5 (Medium) menurut CISA ADP.

Deskripsi (NVD)

An Open Redirect vulnerability exists in the OAuth callback handler in file onlook/apps/web/client/src/app/auth/callback/route.ts in Onlook web application 0.2.32. The vulnerability occurs because the application trusts the X-Forwarded-Host header value without proper validation when constructing a redirect URL. A remote attacker can send a manipulated X-Forwarded-Host header to redirect an authenticated user to an arbitrary external website under their control, which can be exploited for phishing attacks.

Rincian

Terbit di NVD

7 November 2025

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

6.5 (Medium), sumber CISA ADP
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-601: URL Redirection to Untrusted Site ('Open Redirect')

EPSS (30 hari)

0,45% peluang dieksploitasi; lebih tinggi dari 37,1% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://blog.soohyun.tech/CVE-2025-63784-Open-Redirect-in-Onlook-27e557175d2e80ac8641fab59dc36021 exploit · advisory pihak ketiga
• https://tossbank.notion.site/Open-Redirect-in-onlook-27e557175d2e80ac8641fab59dc36021 broken link