CVE-2026-44889: WebOb Auth Bypass Vulnerability

CVE-2026-44889 Overview

CVE-2026-44889 is an open redirect vulnerability in WebOb, a Python library that provides objects for HTTP requests and responses. Versions prior to 1.8.10 normalize the HTTP Location header during a redirect using Python's urljoin. Since Python 3.10, the underlying urlsplit strips ASCII tab, carriage return, and newline characters before parsing. An attacker who influences the redirect target can craft a value containing these characters that gets reinterpreted as a protocol-relative URL pointing to an attacker-controlled host. The flaw bypasses the prior fix introduced for CVE-2024-42353, which only escaped leading double slashes. The vulnerability is classified as [CWE-601] Open Redirect.

Critical Impact
Attackers can redirect authenticated users from a trusted application to an arbitrary external site, enabling phishing and credential theft.

Affected Products

WebOb versions prior to 1.8.10
Python applications using WebOb redirect handling on Python 3.10 or later
Pyramid and other web frameworks that depend on WebOb for response handling

Discovery Timeline

2026-06-22 - CVE-2026-44889 published to the National Vulnerability Database
2026-06-23 - Last updated in NVD database

Technical Details for CVE-2026-44889

Vulnerability Analysis

The vulnerability resides in WebOb's redirect normalization logic. When the library constructs an HTTP Location header, it joins the redirect target with the request URI using Python's urllib.parse.urljoin. Starting with Python 3.10, urlsplit removes ASCII tab (\t), carriage return (\r), and newline (\n) characters before parsing the URL.

This stripping behavior allows a redirect target such as /\t/evil.example.com/path to be reinterpreted after normalization as //evil.example.com/path. The result is a protocol-relative URL whose authority component is controlled by the attacker. Browsers follow the redirect to the external host rather than the intended internal path.

The earlier fix for CVE-2024-42353 escaped a leading double slash to prevent this exact class of attack. Whitespace-stripping in Python 3.10's URL parser reintroduces the bypass by allowing attackers to obscure the double slash with stripped characters.

Root Cause

The root cause is an unsafe interaction between WebOb's input validation and Python's URL parser. WebOb assumes the post-parse representation matches what it validated, but urlsplit silently removes whitespace control characters. This creates a parser differential that defeats the existing double-slash escape.

Attack Vector

Exploitation requires user interaction, typically clicking a crafted link. An attacker supplies a redirect target parameter to an application endpoint that calls into WebOb's redirect functionality. The attacker embeds tab, carriage return, or newline characters to bypass the WebOb sanitizer. The user's browser follows the resulting Location header to the attacker's domain, where phishing or session theft can occur.

The vulnerability mechanism is described in the WebOb GitHub Security Advisory GHSA-fh3h-vg37-cc95.

Detection Methods for CVE-2026-44889

Indicators of Compromise

HTTP Location response headers containing embedded \t, \r, or \n characters before a double slash
Outbound redirects to unexpected external hostnames originating from internal WebOb-based applications
Application logs showing redirect parameters with URL-encoded whitespace such as %09, %0a, or %0d followed by //

Detection Strategies

Inspect web server access logs for redirect query parameters containing whitespace control characters adjacent to slashes
Implement web application firewall rules to flag redirect parameters containing %09, %0a, %0d, or raw whitespace before //
Audit application code for calls to WebOb response objects where the location value is derived from untrusted input

Monitoring Recommendations

Monitor egress traffic from application servers for redirects to domains outside the organization's allowlist
Alert on HTTP 3xx responses where the Location header host does not match the request host or an approved external partner
Track user reports of unexpected redirects from legitimate application URLs

How to Mitigate CVE-2026-44889

Immediate Actions Required

Upgrade WebOb to version 1.8.10 or later across all Python applications and dependent frameworks
Audit application code that constructs redirects from user-supplied parameters and apply strict allowlist validation
Review CDN, reverse proxy, and WAF configurations to strip or reject Location values containing whitespace control characters

Patch Information

The vulnerability is fixed in WebOb 1.8.10. The maintainers updated the redirect normalization logic to account for Python 3.10's whitespace-stripping behavior in urlsplit. See the WebOb Security Advisory GHSA-fh3h-vg37-cc95 for release details and patch commits.

Workarounds

Validate redirect targets against a strict allowlist of internal paths or approved hosts before passing them to WebOb
Reject or sanitize any redirect input containing tab, carriage return, newline characters, or their URL-encoded equivalents
Pin Python to a version prior to 3.10 only as a temporary measure where upgrading WebOb is not immediately possible

bash

# Configuration example
pip install --upgrade 'WebOb>=1.8.10'