CVE-2025-65581: 
C# vulnerability analysis and mitigation

CVE-2025-65581 is an open redirect vulnerability in the Account module of the Volosoft ABP Framework, identified as "ABP Account Module Open Redirect via Improper returnUrl Validation." It affects all versions from 5.1.0 up to (but not including) 10.0.0-rc.2, including the 10.0.0-rc1 release candidate. The vulnerability was published on December 16, 2025, with patches committed the same day. It carries a CVSS v3.1 base score of 5.3 (Medium) (Github Advisory).

The root cause is improper input validation (CWE-601: URL Redirection to Untrusted Site; CWE-20: Improper Input Validation) in the Register.cshtml.cs file within the Volo.Abp.Account.Web NuGet package. Specifically, the OnPostAsync() method used a direct Redirect(ReturnUrl ?? "~/") call without validating whether the ReturnUrl parameter pointed to an internal or external domain, allowing any attacker-supplied URL to be used as a post-registration redirect target. The fix replaced the unsafe Redirect() call with RedirectSafelyAsync(ReturnUrl, ReturnUrlHash), which enforces safe redirect validation (Patch Commit a01adc5, Patch Commit 44a2dc1). No authentication or special privileges are required to exploit this vulnerability, as it is triggered during the public user registration flow.

An attacker can craft a malicious registration link containing an arbitrary external URL in the returnUrl parameter; upon successful registration, the victim is silently redirected to the attacker-controlled site. The primary risk is phishing — users who trust the legitimate application domain may be deceived into submitting credentials or sensitive information to a spoofed site. Confidentiality and integrity impacts are rated None by CVSS, with only a Low availability impact noted, but the social engineering potential makes this a meaningful risk in phishing campaigns targeting users of ABP-based applications (Github Advisory).

1. Reconnaissance: Identify web applications built on the Volosoft ABP Framework (versions 5.1.0 to <10.0.0-rc.2) by examining HTTP response headers, NuGet package references, or application UI patterns characteristic of ABP.
2. Craft malicious URL: Construct a registration URL with a malicious returnUrl parameter pointing to an attacker-controlled domain, e.g., https://target-app.com/Account/Register?returnUrl=https://evil.com/phishing-page.
3. Distribute the link: Send the crafted URL to potential victims via email, social media, or other channels, making it appear as a legitimate invitation or registration link from the trusted application.
4. Victim registers: The victim clicks the link, lands on the legitimate registration page, and completes the registration process.
5. Redirect occurs: Upon successful registration, the application's OnPostAsync() method executes Redirect(ReturnUrl) without validation, transparently redirecting the victim's browser to the attacker's site.
6. Phishing/credential harvest: The attacker's site presents a convincing fake login or data-collection page, harvesting credentials or other sensitive information from the redirected user (Github Advisory, Patch Commit a01adc5).

• Network: HTTP 302 redirect responses from the ABP application's /Account/Register endpoint pointing to external or unexpected domains in the Location header.
• Logs: Web server or application logs showing POST requests to /Account/Register with returnUrl parameters containing external domain URLs (e.g., returnUrl=https://external-domain.com/...).
• Logs: Successful user registrations immediately followed by outbound redirects to non-whitelisted domains in application access logs.
• User Reports: End-user complaints of being redirected to unexpected or suspicious websites immediately after completing registration on the legitimate application.

Upgrade the Volo.Abp.Account.Web NuGet package to version 10.0.0-rc.2 or later, which replaces the unsafe Redirect() call with RedirectSafelyAsync() to enforce URL validation (Github Advisory, Patch Commit 44a2dc1). As a temporary workaround for organizations unable to upgrade immediately, implement server-side validation of the returnUrl parameter to allow only relative URLs or URLs matching a whitelist of trusted domains. Additionally, consider adding security headers (e.g., Content-Security-Policy) and monitoring registration endpoints for suspicious redirect parameters.

The vulnerability received routine coverage from automated CVE tracking services and vulnerability databases shortly after disclosure. A brief mention appeared on Bluesky via the CVE tracking account, and the advisory was indexed by ENISA's EUVD (EUVD-2025-203823). No notable researcher commentary or significant media coverage has been identified beyond standard vulnerability aggregation.