CVE-2026-54770: WebOb open redirect via leading control characters in Location header

CVE-2026-54770 · Severity: medium · CVSS 6.1 · Published 2026-08-20

WebOb is a Python library that handles HTTP requests and responses in web applications. When processing redirect responses, it normalizes the Location header to prevent attackers from redirecting users to external sites. However, due to how Python's urllib handles URLs, leading whitespace and control characters can bypass these checks, allowing an attacker to craft a redirect that sends users to a malicious site. This enables phishing attacks and credential theft, especially when combined with OAuth flows.

Technologies: webob (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2026-54770 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-54770 being exploited in the wild.
How severe is CVE-2026-54770?
Medium severity, with a CVSS score of 6.1, published 20 August 2026.
Which products and versions are affected?
webob (PyPI) < 1.8.11, ECOSYSTEM:introduced=0,fixed=1.8.11.
Is there a fix for CVE-2026-54770?
Yes. webob (PyPI): upgrade to 1.8.11 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-54770 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-54770?
Check whether you run webob (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • webob (PyPI): upgrade to 1.8.11 or later
    pip install "webob>=1.8.11"

Technical details

This is an open redirect vulnerability in WebOb's Location header normalization. The vulnerable code uses `urllib.parse.urljoin()` to make relative redirect targets absolute, checking first for URI schemes and protocol-relative URLs (`//`). However, on Python 3.10+, `urljoin()` silently strips leading and trailing C0 control characters (U+0000–U+001F) and spaces before parsing. Because WebOb's guard checks run on the un-stripped value, a single leading space or control byte bypasses both the scheme regex and `startswith("//")` check, then `urljoin()` removes it and parses the remainder as a protocol-relative or absolute URL. For example, `" //www.example.com/test"` passes validation but redirects to `http://www.example.com/test`. The vulnerability affects three code paths: `Response.location`, `Request.relative_url()`, and HTTP exception classes like `HTTPFound`. The fix replaces `urllib.parse.urljoin()` with WebOb's own RFC 3986 reference-resolution implementation that does not strip whitespace.

Affected products

  • Pylons Project WebOb < 1.8.11

Identifiers

  • CVE-2026-54770
  • GHSA-6hx8-3wjj-gr8g
  • PYSEC-2026-3943

Timeline

  • 2026-08-27: disclosed: Advisory published
  • 2026-08-02: advisory: GitHub Advisory Database entry created
  • 2026-08-27: patched: Fixed in version 1.8.11

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.