Executive brief
Qwik City is a full-stack web framework for building fast applications. A flaw in its URL normalization middleware allows attackers to craft malicious links that redirect users to attacker-controlled websites while appearing to come from the trusted domain. This enables phishing attacks and credential theft without requiring user authentication or special access.
Technical details
An open redirect vulnerability (CWE-601) exists in Qwik City's fixTrailingSlash middleware, which automatically normalizes trailing slashes on page routes. The middleware fails to properly validate or sanitize protocol-relative URLs (starting with //), allowing attackers to inject arbitrary redirect targets. The vulnerability is triggered via a crafted URL that the middleware processes when handling 301 redirects; vulnerable runtimes like Bun that feature catch-all path matching and lack automatic URL normalization are most affected. Exploitation requires no authentication and is network-accessible. An attacker can craft a link that triggers a redirect to any attacker-controlled domain, enabling phishing and token theft. This vulnerability has been patched in qwik-city version 1.19.0.
Affected products
- builder.io qwik-city before 1.19.0
Timeline
- 2026-02-03: disclosed
- 2026-02-03: patched: Fixed in version 1.19.0