CVE-2026-25198: web2py Open Redirect Vulnerability

CVE-2026-25198 Overview

CVE-2026-25198 is an open redirect vulnerability affecting web2py, a popular Python-based web application framework. The vulnerability exists in versions 2.27.1-stable+timestamp.2023.11.16.08.03.57 and prior, allowing attackers to redirect users to arbitrary external websites through specially crafted URLs. This type of vulnerability is commonly exploited in phishing campaigns, where attackers leverage the trust users place in legitimate domains to redirect them to malicious sites.

Critical Impact

Attackers can craft malicious URLs that appear to originate from trusted web2py applications, redirecting unsuspecting users to phishing sites or malware distribution endpoints. This undermines user trust in the affected application and can lead to credential theft or malware infection.

Affected Products

• web2py versions 2.27.1-stable+timestamp.2023.11.16.08.03.57 and prior
• web2py applications using the prevent_open_redirect function in gluon/tools.py
• Any web application built on vulnerable web2py framework versions

Discovery Timeline

• 2026-02-05 - CVE CVE-2026-25198 published to NVD
• 2026-02-05 - Last updated in NVD database

Technical Details for CVE-2026-25198

Vulnerability Analysis

This open redirect vulnerability (CWE-601) occurs in the prevent_open_redirect function within web2py's gluon/tools.py module. The function is designed to prevent attackers from injecting arbitrary URLs into redirect parameters like _next. However, the original implementation had a flaw in how it handled scenarios where the current.request object was unavailable or not properly initialized.

The vulnerable code path could be triggered when the request context was missing, potentially allowing malicious URLs to bypass the open redirect protection. When users click on specially crafted links hosted on trusted web2py applications, they could be silently redirected to attacker-controlled websites, facilitating phishing attacks or drive-by downloads.

Root Cause

The root cause lies in insufficient validation of the request context before extracting host and scheme information. The original prevent_open_redirect function directly accessed current.request.env.http_host and current.request.is_https without first verifying that the current object had a valid request attribute. This assumption could fail in certain execution contexts, leading to unexpected behavior that could be exploited to bypass redirect validation.

Attack Vector

The attack vector is network-based and requires user interaction. An attacker crafts a URL that exploits the open redirect vulnerability, typically embedding it in phishing emails, malicious advertisements, or compromised websites. When a user clicks the link, they initially connect to the legitimate web2py application, which then redirects them to the attacker's site. Because the initial URL points to a trusted domain, users are less likely to suspect malicious intent.

The security patch addresses this vulnerability by adding a defensive check:

 def prevent_open_redirect(url, host=None):
     # Prevent an attacker from adding an arbitrary url after the
     # _next variable in the request.
-    host = host or current.request.env.http_host
-    default_scheme = "https" if current.request.is_https else "http"
+    if hasattr(current, "request"):
+        host = host or current.request.env.http_host
+        default_scheme = "https" if current.request.is_https else "http"
+    else:
+        host = "localhost"
+        default_scheme = "http"
     original = url
 
     if url is not None:

Source: GitHub Commit Reference

Detection Methods for CVE-2026-25198

Indicators of Compromise

• Unusual redirect patterns in web server access logs containing external domains in the _next or similar URL parameters
• User reports of being redirected to unexpected external websites after clicking links to the web2py application
• Web application firewall logs showing blocked attempts to inject external URLs into redirect parameters
• Increased phishing complaints from users who followed links to the affected web2py application

Detection Strategies

• Monitor web server logs for URL patterns containing redirect parameters (_next, redirect, url) with external domain values
• Implement web application firewall rules to detect and block requests with suspicious redirect parameters pointing to untrusted domains
• Deploy endpoint detection solutions to identify phishing attempts that leverage the vulnerable application's domain

Monitoring Recommendations

• Enable detailed logging for all redirect operations within the web2py application
• Configure alerts for redirect requests to domains outside an approved allowlist
• Review referrer headers in conjunction with redirect parameters to identify potential attack patterns
• Implement real-time monitoring for anomalous traffic patterns suggesting exploitation attempts

How to Mitigate CVE-2026-25198

Immediate Actions Required

• Update web2py to the latest version that includes the security patch (commit b4e1ddbd6d40fb30863f6263a67bcdf411a0c6df or later)
• Review application logs for any evidence of exploitation attempts
• Notify users about potential phishing risks if exploitation is suspected
• Implement additional server-side validation for all redirect parameters

Patch Information

The vulnerability has been addressed in a security commit to the web2py repository. The fix adds proper validation to check if the current object has a valid request attribute before accessing host and scheme information. Organizations should update to the patched version by pulling the latest release from the web2py GitHub releases page. Additional details about this vulnerability are available in the JVN Security Notification.

Workarounds

• Implement a web application firewall rule to block requests containing external domains in redirect parameters
• Add custom validation middleware to sanitize all user-supplied redirect URLs before processing
• Configure URL allowlists at the application level to restrict redirects to trusted domains only
• Consider disabling automatic redirect functionality until the patch can be applied

# Configuration example - Apache mod_rewrite rule to block external redirects
RewriteEngine On
RewriteCond %{QUERY_STRING} (_next|redirect|url)=https?://(?!yourdomain\.com) [NC]
RewriteRule .* - [F,L]