CVE-2026-25198 web2py has an Open Redirect Vulnerability
Attackers can redirect users to malicious sites via crafted URLs, facilitating phishing attacks against web2py users.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-25198?
CVE-2026-25198 is a medium-severity vulnerability in web2py, published on 5 Feb 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
web2py versions 2.27.1-stable+timestamp.2023.11.16.08.03.57 and prior contain an open redirect vulnerability. If this vulnerability is exploited, the user may be redirected to an arbitrary website when accessing a specially crafted URL. As a result, the user may become a victim of a phishing attack.
Weakness: CWE-601
Which versions are affected by CVE-2026-25198?
3 open source packages ship an affected version, including web2py.
| Package | Affected | Fixed in |
|---|---|---|
web2py PyPI | All versions | 3.1.1 |
web2py PyPI | All versions | 3.1.1 |
web2py PyPI | All versions | 3.1.1 |
How do I fix CVE-2026-25198?
Upgrade web2py to 3.1.1 or later.
Is CVE-2026-25198 being exploited?
There is no known exploitation of CVE-2026-25198 in the wild and no public exploit code.
Sources
Also known as GHSA-rf8c-3f5p-xv45, PYSEC-2026-3413, UBUNTU-CVE-2026-25198.