SB2025072996 - Open redirect in koa

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2025072996

SB2025072996 - Open redirect in koa

Published: July 29, 2025 Updated: November 9, 2026

Security Bulletin ID SB2025072996
CSH Severity
Medium
Patch available
YES
Number of vulnerabilities 1
Exploitation vector Remote access
Highest impact Data manipulation

Breakdown by Severity

Medium 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 1 vulnerability.


1) Open redirect (CVE-ID: CVE-2025-54420)

CWE-ID: CWE-601 - URL Redirection to Untrusted Site ('Open Redirect')

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows an unauthenticated remote attacker to redirect users of a Koa application to an attacker-controlled external site.

The vulnerability exists due to Koa's redirect handling trusting the user-controlled Referer header when an application invokes the back redirect feature. An unauthenticated remote attacker can supply an external URL in that header when requesting an affected route, causing the application to issue a redirect to that URL.


Remediation

Install update from vendor's website.

References