CVE-2026-25198: web2py Open Redirect Vulnerability
Summary
CVE-2026-25198: web2py has an Open Redirect Vulnerability. Affects web2py versions < 3.1.1. Fixed in 3.1.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
web2py is a full-stack web application framework written in Python, designed to facilitate the rapid development of web applications. It is known for its simplicity and ease of use, allowing developers to create applications with minimal setup. However, certain versions of web2py are susceptible to an Open Redirect vulnerability, which can lead to security risks for users.
Vulnerability Detail
The Open Redirect vulnerability in web2py versions 2.27.1-stable+timestamp.2023.11.16.08.03.57 and earlier allows attackers to craft malicious URLs that redirect users to arbitrary websites. This can result in phishing attacks, where users may unknowingly provide sensitive information to malicious sites. The vulnerability arises from improper validation of URLs, enabling attackers to manipulate redirection behavior.
How To Fix
Latest published version: 2.1.1 as of 23 Oct 2026
pip install --upgrade "web2py==2.1.1"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
3.1.1
This is the first release that contains the fix.
pip install --upgrade "web2py==3.1.1"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid using URLs that could be manipulated for redirection. Ensure that any links provided to users are from trusted sources and validate user input to prevent unauthorized redirects.
Conclusion
The Open Redirect vulnerability in web2py poses a significant risk to users, potentially leading to phishing attacks. It is crucial to update to the patched version 3.1.1 or later to mitigate this risk. Additionally, utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for web2py →
FAQ
An Open Redirect vulnerability allows attackers to redirect users to arbitrary URLs, potentially leading to phishing attacks or other malicious activities.
You can check if your application is affected by using Vulert, which monitors and alerts for open-source vulnerabilities. Visit Vulert Scanner to test your application without signup.
If exploited, this vulnerability can lead to phishing attacks, where users are tricked into providing sensitive information to malicious websites.
Yes, the vulnerability has been patched in web2py version 3.1.1 and later. It is recommended to update to this version.
The CVSS score of this vulnerability is 4.7, indicating a moderate level of risk.
Related vulnerabilities
Recent vulnerabilities recorded for web2py.
