CVE-2026-54770 - WebOb: Open redirect in Location header normalization via leading C0 control / space characters
Brief
CVE ID : CVE-2026-54770
Published : Aug. 20, 2026, 4:31 p. m.
- 37 minutes ago
Description : WebOb provides objects for HTTP requests and responses. Prior to 1.
- 11, Response. _make_location_absolute() in src/webob/response. py checks a Location value for a URI scheme or leading double slash before urllib. parse. urljoin() strips leading C0 control characters and spaces.
An attacker-controlled value such as a space followed by a protocol-relative or absolute URL can therefore bypass SCHEME_RE and startswith("//") checks and be normalized to an off-host redirect. Request. relative_url() and webob. exc. _HTTPMove subclasses, including HTTPFound, are also affected because they use the same unsafe URL joining behavior or bypass the earlier normalization path.