CVE-2026-64941: Phoenix LiveView Open Redirect Vulnerability

CVE-2026-64941 Overview

CVE-2026-64941 is an open redirect vulnerability [CWE-601] in the phoenix_live_view library for the Elixir Phoenix framework. The redirect/2 function validates the :to parameter through the private validate_local_url!/2 guard in lib/phoenix_live_view.ex. That guard rejects a leading // and any backslash but does not filter ASCII tab, line feed, or carriage return characters. Browsers strip those three characters before parsing a URL, so a value such as /<TAB>/example.com passes validation as a local path and is then resolved as the scheme-relative URL //example.com. An attacker can send a victim's browser to any origin they choose.

Critical Impact
Attackers can craft :to values that bypass local-URL validation and redirect users to attacker-controlled origins, enabling phishing and credential harvesting against Phoenix LiveView applications.

Affected Products

phoenix_live_view from 0.5.0 before 1.0.19
phoenix_live_view from 1.1.0-rc.0 before 1.1.33
phoenix_live_view from 1.2.0-rc.0 before 1.2.9

Discovery Timeline

2026-08-10 - CVE-2026-64941 published to NVD
2026-08-12 - Last updated in NVD database

Technical Details for CVE-2026-64941

Vulnerability Analysis

The flaw resides in the private helper validate_local_url!/2 in lib/phoenix_live_view.ex. This function is intended to guarantee that redirect/2 targets a path within the application. Its allow-list logic rejects targets beginning with // and rejects any backslash character, but it does not account for ASCII tab (\t, 0x09), line feed (\n, 0x0A), or carriage return (\r, 0x0D). All modern browsers strip those three characters from URLs before parsing per the WHATWG URL standard. As a result, the string /\t/attacker.example looks like a rooted local path to Phoenix but is normalized by the browser into //attacker.example, which is then interpreted as a scheme-relative URL pointing to a foreign origin. Live navigation helpers share the guard but are not exploitable because the client expands their target against the current origin. push_patch/2 is affected in releases prior to 0.7.0, before that expansion was added.

Root Cause

The root cause is incomplete input validation of the redirect target. The @invalid_local_url_chars list contained only the backslash. The validator treated the ASCII whitespace-adjacent control characters as safe path content rather than as URL delimiters that browsers ignore, producing a parser differential between server-side validation and client-side URL resolution.

Attack Vector

An attacker delivers a crafted link to a Phoenix LiveView endpoint that accepts a user-controlled parameter passed into redirect(to: ...). Exploitation requires user interaction, typically a click on the attacker's URL. After the redirect completes the victim lands on the attacker's origin under the trust of the original Phoenix application, which is useful for phishing, OAuth-flow abuse, and downstream credential theft.

text

     raise ArgumentError, "socket already prepared to redirect with #{inspect(to)}"
   end
 
-  @invalid_local_url_chars ["\\"]
+  # We add \r and \n since those are checked on Phoenix at the header level
+  @invalid_local_url_chars ["\\", "/%09", "/\t", "\n", "\r"]
 
   defp validate_local_url!("//" <> _ = to, where) do
     raise_invalid_local_url!(to, where)

Source: GitHub commit 0b8c7331. The patch expands @invalid_local_url_chars to include /%09, /\t, \n, and \r, closing the parser differential.

Detection Methods for CVE-2026-64941

Indicators of Compromise

Inbound HTTP requests with query or form parameters containing raw %09, %0A, or %0D sequences immediately after a / character, especially when the parameter is used as a redirect target.
Server-generated Location response headers whose values begin with / followed by a tab, LF, or CR and then a hostname.
Referer chains where Phoenix application URLs are followed by navigation to unrelated external origins immediately after a redirect response.

Detection Strategies

Inspect web application firewall (WAF) and reverse proxy logs for URL-encoded control characters (%09, %0A, %0D) inside redirect-related parameters such as redirect_to, next, return_to, or to.
Grep application source for calls to redirect(to: ...) where the target originates from user-supplied input, and confirm the deployed phoenix_live_view version.
Alert on 302/303 responses issued by Phoenix LiveView endpoints when the Location header targets an origin other than the application's own hostnames.

Monitoring Recommendations

Enable structured logging of outbound Location headers and forward those logs to a centralized SIEM for cross-origin redirect analytics.
Track user click paths that traverse a Phoenix LiveView redirect endpoint immediately before landing on a domain outside the corporate allow-list.
Add dependency-scanning checks that flag phoenix_live_view versions below 1.0.19, 1.1.33, or 1.2.9.

How to Mitigate CVE-2026-64941

Immediate Actions Required

Upgrade phoenix_live_view to 1.0.19, 1.1.33, or 1.2.9 depending on the release branch in use.
Audit application code for user-controlled values flowing into redirect/2 or push_patch/2 and restrict them to a hard-coded allow-list of internal paths.
Review recent access logs for exploitation attempts that used %09, %0A, or %0D inside redirect parameters.

Patch Information

The fix is implemented across three commits that update @invalid_local_url_chars in lib/phoenix_live_view.ex to include /%09, /\t, \n, and \r. See GitHub commit 0b8c7331, GitHub commit 1c164f83, and GitHub commit 2068b304. Full advisory details are in the GitHub Security Advisory GHSA-36m4-rm57-3prf and the Erlef CNA record.

Workarounds

Wrap user-supplied redirect targets with a custom validator that rejects any string containing \t, \n, \r, or their percent-encoded forms before passing them to redirect/2.
Constrain redirects to a server-side allow-list of known internal routes rather than accepting arbitrary paths from clients.
Terminate untrusted Location header values at the reverse proxy or WAF layer if patching cannot be performed immediately.

bash

# Update mix.exs to a fixed version, then fetch and compile
# Choose the line matching your current release branch
{:phoenix_live_view, "~> 1.0.19"}
{:phoenix_live_view, "~> 1.1.33"}
{:phoenix_live_view, "~> 1.2.9"}

mix deps.update phoenix_live_view
mix deps.compile phoenix_live_view