CVE-2026-25198: web2py has an Open Redirect Vulnerability

February 5, 2026

web2py versions 2.27.1-stable+timestamp.2023.11.16.08.03.57 and prior contain an Open Redirect vulnerability. If this vulnerability is exploited, the user may be redirected to an arbitrary website when accessing a specially crafted URL. As a result, the user may become a victim of a phishing attack.

References

github.com/advisories/GHSA-rf8c-3f5p-xv45
github.com/web2py/web2py
github.com/web2py/web2py/commit/b4e1ddbd6d40fb30863f6263a67bcdf411a0c6df
github.com/web2py/web2py/releases
jvn.jp/en/jp/JVN46925341
nvd.nist.gov/vuln/detail/CVE-2026-25198
web2py.com/

Code Behaviors & Features

Detect and mitigate CVE-2026-25198 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →