CVE-2026-30346: DevPush Open Redirect Vulnerability

CVE-2026-30346 Overview

An open redirect vulnerability exists in the /api/google/authorize endpoint of hunvreus DevPush v0.3.2. This flaw allows attackers to redirect users to malicious sites by supplying a crafted URL parameter. Open redirect vulnerabilities (CWE-601) enable phishing attacks by abusing the trust users place in legitimate domains, making malicious redirects appear credible.

Critical Impact
Attackers can leverage this vulnerability to redirect authenticated users to phishing sites, potentially leading to credential theft, malware distribution, or session hijacking by exploiting user trust in the DevPush application.

Affected Products

hunvreus DevPush v0.3.2
DevPush installations using the /api/google/authorize endpoint for Google OAuth authentication

Discovery Timeline

2026-04-27 - CVE CVE-2026-30346 published to NVD
2026-04-27 - Last updated in NVD database

Technical Details for CVE-2026-30346

Vulnerability Analysis

The vulnerability resides in the OAuth authorization flow within DevPush, specifically in the /api/google/authorize endpoint. This endpoint is designed to facilitate Google OAuth authentication but fails to properly validate the redirect URL parameter before performing the redirect operation.

When a user initiates authentication, the application accepts a return URL that specifies where to redirect the user after successful authentication. However, the endpoint does not implement adequate validation to ensure the redirect URL points to a trusted domain. This allows an attacker to craft a malicious link that appears to originate from the legitimate DevPush application but redirects users to an attacker-controlled site.

The vulnerability requires user interaction—a victim must click on a crafted link—but the low attack complexity combined with no authentication requirements makes this an accessible attack vector for threat actors.

Root Cause

The root cause is improper URL validation in the /api/google/authorize endpoint (CWE-601: URL Redirection to Untrusted Site). The application fails to implement an allowlist of permitted redirect destinations or adequate validation to prevent redirects to external domains.

DevPush does not sanitize or validate the URL parameter against a list of trusted domains before issuing the HTTP redirect response. This lack of input validation allows arbitrary URLs to be passed through the OAuth flow.

Attack Vector

The attack is network-based and requires user interaction. An attacker crafts a URL that includes the legitimate DevPush domain but specifies a malicious redirect destination. Common attack scenarios include:

Phishing Campaigns: Attackers send emails containing links to the vulnerable endpoint with a redirect to a credential harvesting page
Social Engineering: The legitimate domain in the URL lends credibility to the malicious link
Session Token Theft: If OAuth tokens are passed via URL parameters, they may be captured by the attacker's site

The vulnerability manifests in the redirect handling logic of the /api/google/authorize endpoint. Attackers construct URLs that leverage the trusted DevPush domain while specifying an external redirect target. For detailed technical analysis, refer to the GitHub Gist Code Snippet documenting this vulnerability.

Detection Methods for CVE-2026-30346

Indicators of Compromise

Unusual outbound redirects from the /api/google/authorize endpoint to external domains
Log entries showing authorization requests with suspicious or external redirect URL parameters
User reports of being redirected to unexpected or suspicious websites after clicking DevPush links
Network traffic showing HTTP 302/301 responses from DevPush redirecting to unrecognized domains

Detection Strategies

Monitor web application logs for requests to /api/google/authorize containing redirect parameters pointing to external domains
Implement URL pattern matching rules to detect redirect URLs that do not match trusted application domains
Deploy web application firewall (WAF) rules to flag or block requests with suspicious redirect parameters
Use SIEM correlation rules to identify patterns of redirect abuse across multiple user sessions

Monitoring Recommendations

Enable detailed logging for all OAuth-related endpoints, including full URL parameters
Configure alerts for redirect responses (HTTP 301/302) pointing to domains outside your organization's allowlist
Review access logs periodically for anomalous patterns in the /api/google/authorize endpoint
Implement user behavior analytics to detect click patterns indicative of phishing campaigns

How to Mitigate CVE-2026-30346

Immediate Actions Required

Upgrade DevPush to a patched version if available from the GitHub Repository for DevPush
Implement server-side URL validation with a strict allowlist of permitted redirect destinations
Block or disable the /api/google/authorize endpoint if not actively required until a patch is applied
Educate users about the risks of clicking on links from untrusted sources

Patch Information

At the time of publication, the vulnerability was identified in DevPush v0.3.2. Users should monitor the GitHub DevPush Release 0.3.2 page and the project repository for security updates. Contact the vendor or check the GitHub Repository for DevPush for the latest patch information.

Workarounds

Implement a reverse proxy or WAF rule to validate redirect URLs against an allowlist before forwarding requests
Restrict access to the /api/google/authorize endpoint to authenticated users only
Deploy Content Security Policy (CSP) headers to limit redirect destinations
Use network-level filtering to block outbound connections to known malicious domains

bash

# Example nginx configuration to restrict redirects
location /api/google/authorize {
    # Validate redirect parameter against allowlist
    if ($arg_redirect_uri !~ "^https://trusted-domain\.com") {
        return 403;
    }
    proxy_pass http://devpush_backend;
}