Open redirect in Crow - #VU147369
Published: September 8, 2026
Vulnerability identifier: #VU147369
CSH Severity: Medium
CVSS v4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-601
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to redirect victims to an attacker-controlled site.
The vulnerability exists due to improper validation of redirect targets in the automatic trailing-slash redirect handling in include/crow/routing.h when processing a request URL beginning with two slashes. A remote attacker can send a victim a crafted URL to redirect the victim to an attacker-controlled origin.
Exploitation requires a matching root-level trailing-slash dynamic path route and user interaction. Reverse proxies that reject or normalize double slashes may prevent the request from reaching Crow.
Affected software
Crow
Remediation
Install security update from vendor's website.
Crow - update to 1.3.4