5.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-65581

CVE-2025-65581: ABP Account Module has an Open Redirect through Improper validation in its register function

An open redirect vulnerability exists in the Account module in Volosoft ABP Framework >= 5.1.0 and < 10.0.0-rc.2. Improper validation of the returnUrl parameter in the register function allows an attacker to redirect users to arbitrary external domains.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-65581

CVE-2025-65581:

5.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
Volo.Abp.Account.Web	nuget	>= 5.1.0, < 10.0.0-rc.2	10.0.0-rc.2

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The analysis of the provided commits clearly indicates that the vulnerability lies within the OnPostAsync method of the RegisterModel class in the Volo.Abp.Account.Web module. The initial commit a01adc58464d278ca817c4bbb6cbce30f155d0d1 replaces a direct and unsafe Redirect(ReturnUrl) with a call to RedirectSafelyAsync. This change explicitly highlights the point of vulnerability. The subsequent commit 44a2dc14e933f3ce1ca93f9313d836694ab77d1d further refines the fix by passing an additional parameter ReturnUrlHash to RedirectSafelyAsync, reinforcing the security measures. The root cause of the vulnerability is the lack of input validation on the ReturnUrl parameter, which is a common cause of open redirect vulnerabilities. An attacker could exploit this by tricking a user into clicking a crafted registration link with a malicious returnUrl query parameter, leading to the user being redirected to a phishing site or other malicious domain after completing the registration process.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.