6.1

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-44889

CVE-2026-44889: WebOb: Location header normalization during redirect leads to open redirect

WebOb provides objects for HTTP requests and responses. Prior to 1.8.10, the normalization of the HTTP Location header during a redirect is vulnerable to an open redirect: WebOb joins the redirect target to the request URI using Python's urljoin, and since Python 3.10 the underlying urlsplit strips ASCII tab, carriage return, and newline characters before parsing, so a redirect target containing such characters can be reinterpreted as a protocol-relative URL whose authority is an attacker-controlled host. This bypasses the CVE-2024-42353 fix that escaped a leading double slash, allowing an attacker who influences the redirect location to send users to an arbitrary external site instead of the intended one. This vulnerability is fixed in 1.8.10.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-44889

CVE-2026-44889:

6.1

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

SSVC / BOD 26-04 ↗

Exploitation NoneAutomatable NoTech Impact Partial

Select your environment

→SSVCDeferfix on upgrade

Runtime reachability resolves your actual outcome.Book a demo

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
webob	pip	<= 1.8.9	1.8.10

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is an open redirect in the WebOb library, identified as CVE-2024-42353. It's a bypass of a previous fix for a similar issue. The root cause lies in the Response._make_location_absolute method, which is supposed to normalize the Location header for redirects.

In vulnerable versions, this function does not account for a change in behavior in Python 3.10 and newer, where urllib.parse.urlsplit (used internally by urllib.parse.urljoin) strips certain ASCII whitespace characters like tabs, carriage returns, and newlines from the URL before parsing.

An attacker can exploit this by crafting a Location header value such as /\t/attacker.com. The vulnerable _make_location_absolute function fails to sanitize the tab character. When this value is passed to urljoin, the tab is stripped, transforming the path into //attacker.com. urljoin then interprets this as a protocol-relative URL, causing the redirect to go to the attacker-controlled domain instead of the intended one.

The patch in commit 2b9fbedafb31180c910cf8526e9ea72b4603d0bc fixes this by explicitly stripping these whitespace characters from the location value at the beginning of the _make_location_absolute function, before any other processing. This ensures that such bypass attempts are neutralized regardless of the underlying Python version's urljoin behavior.

The Response.__call__ method is also identified as a key function because it is the one that triggers the call to the vulnerable _make_location_absolute method when handling a redirect response, making it an essential part of the vulnerable execution path.

Vulnerable functions

Response._make_location_absolute

src/webob/response.py

This static method is responsible for normalizing the 'Location' header. In vulnerable versions, it fails to strip ASCII whitespace characters (tab, carriage return, newline) from the location value before passing it to `urllib.parse.urljoin`. On Python 3.10 and later, `urljoin` internally strips these characters. This allows a crafted location string like `/\t/attacker.com` to bypass checks and be interpreted as a protocol-relative URL `//attacker.com`, leading to an open redirect.

Response.__call__

src/webob/response.py

When a `Response` object is used as a WSGI application, this method is invoked. For redirect responses (status codes 301, 302, etc.), it calls the vulnerable `_make_location_absolute` method to process the `Location` header. Therefore, this function is a key part of the execution flow that leads to the open redirect vulnerability.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.