CVE-2025-65581

Published: Dec 16, 2025Modified: Jun 17, 2026

5.3

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Exploitability: 3.9 / Impact: 1.4

Source: NVD

Description

An open redirect vulnerability exists in the Account module in Volosoft ABP Framework >= 5.1.0 and < 10.0.0-rc.2. Improper validation of the returnUrl parameter in the register function allows an attacker to redirect users to arbitrary external domains.

Affected (2)

Products: Volosoft: Abp

1 product

Configuration A

2 vulnerable

Vulnerable Software	Affected Versions
Volosoft Abp	From 5.1.0 to 10.0.0
Volosoft Abp	Version 10.0.0 rc1

Related CWEs

URL Redirection to Untrusted Site ('Open Redirect')

A web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a Redirect. This simplifies phishing attacks.

References (2)

https://github.com/abpframework/abp/commit/44a2dc14e933f3ce1ca93f9313d836694ab77d1d

Source: cve@mitre.org

Patch

https://github.com/abpframework/abp/commit/a01adc58464d278ca817c4bbb6cbce30f155d0d1

Source: cve@mitre.org

Patch

Timeline

No history available yet.