Open redirect in koa - CVE-2025-54420
Published: July 29, 2025 / Updated: November 9, 2026
Vulnerability identifier: #VU162935
CSH Severity: Medium
CVSS v4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2025-54420
CWE-ID: CWE-601
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows an unauthenticated remote attacker to redirect users of a Koa application to an attacker-controlled external site.
The vulnerability exists due to Koa's redirect handling trusting the user-controlled Referer header when an application invokes the back redirect feature. An unauthenticated remote attacker can supply an external URL in that header when requesting an affected route, causing the application to issue a redirect to that URL.
Affected software
koa
How to mitigate CVE-2025-54420
Install security update from vendor's website.
koa - addressed in versions 2.16.2, 3.0.1