CVE-2026-85676: Dub URL Shortener Open Redirect Vulnerability

CVE-2026-85676 Overview

CVE-2026-85676 is an open redirect vulnerability [CWE-601] in Dub, an open-source link management platform. The redir_url query parameter is accepted on every short link without validation or domain allowlist enforcement. Attackers can append redir_url to any short link and redirect visitors to arbitrary external URLs through the trusted Dub domain. The flaw bypasses destination blacklists and can enable phishing when link cloaking is enabled. The issue is tracked in the Dub repository and disclosed in a VulnCheck advisory.

Critical Impact
Attackers can weaponize any legitimate Dub short link to redirect users to attacker-controlled destinations, defeating destination blacklists and increasing phishing success rates.

Affected Products

Dub (link management platform) - see GitHub Project Repository
Vulnerable code path in apps/web/lib/middleware/utils/get-final-url.ts - see GitHub Middleware Utility File
Deployments using short links with link cloaking enabled

Discovery Timeline

2026-09-04 - CVE-2026-85676 published to NVD
2026-09-04 - Last updated in NVD database

Technical Details for CVE-2026-85676

Vulnerability Analysis

Dub resolves short links through middleware that determines the final destination URL. The get-final-url.ts utility accepts a redir_url query parameter and returns it as the redirect target without validating the scheme, host, or checking membership in an allowlist of trusted domains. As a result, any short link served by a Dub-hosted domain can be augmented with an attacker-supplied destination.

Because the redirect originates from a trusted Dub domain, downstream security controls that rely on domain reputation may permit the initial navigation. Link cloaking further conceals the eventual destination from the user, increasing the credibility of phishing lures that abuse this behavior.

Additional detail is provided in the VulnCheck Security Advisory and tracked upstream in GitHub Issue #4337.

Root Cause

The root cause is missing input validation on the redir_url query parameter. The middleware trusts user-controlled input as the final redirect destination and does not enforce a domain allowlist, scheme restriction, or blacklist consultation for values supplied via redir_url. This is a classic URL Redirection to Untrusted Site (Open Redirect) weakness [CWE-601].

Attack Vector

Exploitation requires only that a user click a crafted short link. An attacker appends ?redir_url=https://attacker.example/phish to any existing short link on the Dub-hosted domain. When the short link is visited, the middleware returns the attacker-supplied URL as the redirect target, sending the victim to the attacker's site through a trusted intermediary domain. No authentication is required, and destination blacklists configured within Dub are bypassed because they are not consulted for redir_url values.

No verified exploit code is published. See the VulnCheck Security Advisory for the parameter behavior and reproduction details.

Detection Methods for CVE-2026-85676

Indicators of Compromise

HTTP requests to Dub short-link endpoints containing a redir_url query parameter that references external domains outside the organization's approved allowlist.
Web proxy or CDN logs showing 3xx redirects from Dub-hosted domains to previously unseen or low-reputation destinations.
User reports of phishing pages reached through a legitimate-looking short link on a Dub domain.

Detection Strategies

Inspect access logs for the regex pattern [?&]redir_url= on all Dub short-link routes and flag values whose host does not match an approved destination list.
Correlate short-link visits with subsequent navigation to newly registered domains, uncategorized URLs, or credential-harvesting page signatures.
Add a WAF or reverse-proxy rule that alerts when the redir_url parameter is present on any request path handled by the Dub middleware.

Monitoring Recommendations

Forward Dub application logs and CDN access logs to a central analytics platform and build dashboards for redir_url usage over time.
Monitor outbound URL categorization metrics for spikes in redirects originating from Dub-hosted domains.
Alert on any use of redir_url from unauthenticated sources or from short links associated with high-visibility campaigns.

How to Mitigate CVE-2026-85676

Immediate Actions Required

Update Dub to a version that validates the redir_url parameter against a strict domain allowlist. Track upstream progress in GitHub Issue #4337.
Disable or restrict the redir_url query parameter at the reverse proxy or WAF until a validated patched build is deployed.
Audit existing short links for abuse and rotate or delete any links that show anomalous redir_url traffic.

Patch Information

At the time of NVD publication on 2026-09-04, no fixed version identifier is listed in the CVE record. Consult the Dub project repository and GitHub Issue #4337 for remediation status, and review the VulnCheck Security Advisory for vendor guidance.

Workarounds

Enforce a domain allowlist in apps/web/lib/middleware/utils/get-final-url.ts so that only vetted destination hosts are accepted from redir_url.
Strip or reject the redir_url query parameter at an upstream proxy, CDN edge worker, or WAF rule for all short-link requests.
Disable link cloaking for public-facing short links to reduce the phishing utility of any residual redirect abuse.
Educate end users and downstream email security gateways to treat short-link redirects with redir_url parameters as suspicious.

bash

# Example NGINX rule to drop requests containing the redir_url parameter
if ($arg_redir_url) {
    return 400;
}