CVE-2025-65581: ABP Account Module has an Open Redirect through Improper validation in its register function

December 16, 2025

An open redirect vulnerability exists in the Account module in Volosoft ABP Framework >= 5.1.0 and < 10.0.0-rc.2. Improper validation of the returnUrl parameter in the register function allows an attacker to redirect users to arbitrary external domains.

References

github.com/abpframework/abp
github.com/abpframework/abp/commit/44a2dc14e933f3ce1ca93f9313d836694ab77d1d
github.com/abpframework/abp/commit/a01adc58464d278ca817c4bbb6cbce30f155d0d1
github.com/advisories/GHSA-vfm5-cr22-jg3m
nvd.nist.gov/vuln/detail/CVE-2025-65581

Code Behaviors & Features

Detect and mitigate CVE-2025-65581 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →