Open redirect in Angular - #VU153181
Published: October 2, 2026
Vulnerability identifier: #VU153181
CSH Severity: Medium
CVSS v4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-601
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to redirect users to an arbitrary external domain.
The vulnerability exists due to improper validation of normalized URLs in ServerPlatformLocation's resolveUrl and parseUrl functions when processing crafted request URLs containing dot-segments and multiple slashes. A remote attacker can send a specially crafted request URL to redirect users to an arbitrary external domain.
Only applications using server-side rendering are affected, and user interaction is required to follow the redirect.
Affected software
Angular
Remediation
Install security update from vendor's website.
Angular - addressed in versions 20.3.33, 21.2.25, 22.2.1