CVE-2020-28724: Open Redirect in werkzeug
Summary
CVE-2020-28724: Open Redirect in werkzeug. Affects werkzeug versions < 0.11.6. Fixed in 0.11.6. How to fix ↓
Also tracked for
- python-werkzeug · Debian:11
The same CVE-2020-28724 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Werkzeug is a Python library that provides essential utilities for building web applications. It is widely used for its simplicity and flexibility in handling HTTP requests and responses. However, versions prior to 0.11.6 are susceptible to an open redirect vulnerability. This vulnerability allows an attacker to manipulate the URL and redirect users to malicious websites by exploiting a double slash in the URL.
Vulnerability Detail
The open redirect vulnerability in werkzeug poses a moderate risk to web applications. By inserting a double slash in the URL, an attacker can deceive users into visiting malicious websites that appear legitimate. This can lead to various attacks, such as phishing, malware distribution, or stealing sensitive information. The vulnerability has been assigned the CVE identifier CVE-2020-28724 and has a CVSS score of 6.1.
How To Fix
Latest published version: 3.1.9 as of 22 Oct 2026
pip install --upgrade "werkzeug==3.1.9"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.11.6
This is the first release that contains the fix.
pip install --upgrade "werkzeug==0.11.6"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the latest version is not immediately feasible, a temporary workaround can be implemented. Developers can manually validate and sanitize the URL input to prevent the insertion of double slashes. This can be achieved by using URL parsing and validation libraries or implementing custom validation logic.
Conclusion
In conclusion, the open redirect vulnerability in werkzeug can be mitigated by upgrading to version 0.11.6 or later. Developers should promptly update their dependencies to ensure the security of their web applications. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for werkzeug →
FAQ
An open redirect vulnerability allows an attacker to manipulate a URL and redirect users to arbitrary websites. This can be exploited to deceive users into visiting malicious websites that appear legitimate.
The vulnerability in werkzeug arises from a failure to properly validate and sanitize URL inputs. By inserting a double slash in the URL, an attacker can bypass validation checks and redirect users to malicious websites.
The open redirect vulnerability in werkzeug can lead to various attacks, including phishing, malware distribution, and the theft of sensitive information. It poses a moderate risk to web applications and their users.
Yes, this vulnerability has been assigned the CVE identifier CVE-2020-28724.
The CVSS score of this vulnerability is 6.1, indicating a moderate severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for werkzeug.
