CVE-2026-25198: 
Python vulnerability analysis and mitigation

CVE-2026-25198 is an open redirect vulnerability (CWE-601) in the web2py Python web framework affecting versions 2.27.1-stable+timestamp.2023.11.16.08.03.57 and prior (pip package versions prior to 3.1.1). When exploited, users accessing a specially crafted URL may be silently redirected to an arbitrary external website, enabling phishing attacks. The vulnerability was disclosed on February 5, 2026, and was reported by JPCERT/CC (JVN#46925341). It carries a CVSS v3.1 base score of 4.7 (Medium) and a CVSS v4.0 base score of 5.1 (Medium) (Github Advisory, Feedly).

The root cause lies in insufficient validation of redirect URLs within the prevent_open_redirect() function in gluon/tools.py. The function failed to properly handle certain URL patterns — specifically paths beginning with / followed by non-alphanumeric characters (e.g., /%09/www.example.org/) — that could be interpreted by browsers as protocol-relative or external redirects, bypassing the intended host-matching logic. The fix adds a check that returns None (blocking the redirect) when a URL starts with / and the first path segment is not alphanumeric, and also adds a fallback for cases where current.request is unavailable (web2py commit, Github Advisory). No authentication is required to exploit this vulnerability, but user interaction (clicking a crafted link) is necessary.

Successful exploitation allows an unauthenticated attacker to redirect victims from a trusted web2py application URL to an arbitrary attacker-controlled website, facilitating phishing attacks, credential harvesting, or malware distribution. There is no direct impact on the confidentiality or availability of the vulnerable system itself; the primary risk is to the integrity of the user's browsing session and the trust relationship between users and the web2py application. The scope is changed in that the impact extends beyond the vulnerable system to the user's browser environment (Github Advisory, Feedly).

No public proof-of-concept exploit code or evidence of in-the-wild exploitation has been reported as of the disclosure date (Feedly). The EPSS score is approximately 0.016% (4th percentile), indicating a low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been identified.

1. Identify target application: Locate a publicly accessible web2py application running a version prior to 3.1.1 (pip) or 2.27.1-stable+timestamp.2023.11.16.08.03.57 and earlier.
2. Craft malicious URL: Construct a URL targeting the web2py application's redirect mechanism (e.g., using the _next parameter) with a specially crafted path such as /%09/www.attacker.com/ or similar non-alphanumeric path segment that bypasses the prevent_open_redirect() validation.
3. Deliver the link: Send the crafted URL to a victim via email, social media, or other phishing channels, making it appear to originate from the legitimate web2py application domain.
4. User interaction: When the victim clicks the link, their browser follows the redirect from the trusted web2py domain to the attacker-controlled site.
5. Achieve objective: The victim lands on a phishing page mimicking the original application or another trusted service, enabling credential theft or malware delivery (web2py commit, Github Advisory).

• Network: HTTP requests to web2py application endpoints containing _next parameters with values like /%09/, / /, or other tab/whitespace-encoded path segments followed by external domain names; outbound HTTP 302 redirects from the web2py server to unexpected external domains.
• Logs: Web server access logs showing requests with URL-encoded tab characters (%09) or other non-alphanumeric characters in the first path segment of _next parameter values; repeated redirect responses (HTTP 302) pointing to domains not associated with the application.
• Application Logs: Entries in web2py logs showing _next parameter values containing external hostnames or suspicious path patterns passed to the redirect handler.

Upgrade web2py to version 3.1.1 (pip) or any release after 2.27.1-stable, which includes the patch in commit b4e1ddb that adds proper validation of redirect URL path segments (web2py commit, Github Advisory). As a workaround where immediate upgrade is not possible, implement server-side or WAF rules to reject requests where the _next parameter contains non-alphanumeric characters in the first URL path segment. Additionally, consider implementing an allowlist of permitted redirect destinations and deploying security awareness training to help users recognize suspicious URLs.

The vulnerability was reported through JPCERT/CC and published in the Japan Vulnerability Notes database (JVN#46925341), indicating coordinated disclosure with the web2py maintainers (JVN Advisory). Red Hat also tracked the vulnerability for potential impact on their products (Red Hat CVE). No significant broader community or social media discussion has been identified beyond standard vulnerability database aggregation.