CVE-2025-65581CWE-601

CVE-2025-65581

Medium · published December 16, 2025

CVSS v3.1
5.3
EPSS
0%
Percentile
19.2
In the wild
Unconfirmed
What it is

An open redirect vulnerability exists in the Account module in Volosoft ABP Framework >= 5.1.0 and < 10.0.0-rc.2. Improper validation of the returnUrl parameter in the register function allows an attacker to redirect users to arbitrary external domains.

The record
Technical detail
CVSS v3.1
5.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
CVSS v4.0
Not supplied
EPSS
0.00278 · 19.2th percentile
Weakness
CWE-601 · URL Redirection to Untrusted Site ('Open Redirect')
Published
2025-12-16T23:16Z
Affected products (2)
ProductVersionsFixed in
volosoft/abp≥ 5.1.0, < 10.0.010.0.0
volosoft/abpall versions—
References (2)
https://github.com/abpframework/abp/commit/44a2dc14e933f3ce1ca93f9313d836694ab77d1d · [email protected]https://github.com/abpframework/abp/commit/a01adc58464d278ca817c4bbb6cbce30f155d0d1 · [email protected]
EPSS history
Timeline
  • 16 DEC 00:00Z
    An open redirect vulnerability exists in the Account module in Volosoft ABP Framework >= 5.1.0 and < 10.0.0-rc.2
    cvelistv5