CVE-2026-49820 PUBLISHED

Probo has an open redirect bypass via path normalization

Assigner: GitHub_M
Reserved: 01.06.2026 Published: 13.08.2026 Updated: 13.08.2026

Probo is a self-hostable governance, risk, and compliance (GRC) platform built for engineering and security teams. Probo's saferedirect package validates redirect URLs used across authentication flows (OIDC, SAML, session transfer, OAuth connectors, and trust-center magic links). Prior to version 0.19.3.1, the validator only inspected the second character of relative paths, so a URL like /../\evil.com passed validation because the second character is .. Go's http.Redirect normalizes this path to /\evil.com before setting the Location header. Browsers can interpret the backslash as a host separator and redirect the user to an external domain (https://evil.com), bypassing the intended same-origin restriction. This enables open-redirect phishing: an attacker can craft a continue parameter (or embed a malicious URL in a session-transfer token) that appears to originate from a trusted Probo domain but redirects victims elsewhere. This is fixed in go.probo.inc/probo 0.193.1 by normalizing relative paths with path.Clean before validation, rejecting backslashes (including percent-encoded %5c) anywhere in the path, and re-checking the normalized result for protocol-relative and backslash prefixes. Self-hosted deployments should upgrade to probod v0.194.1 or later. SaaS deployments on getprobo.com are patched. No practical workaround is available for self-hosted installations.

Metrics

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N
CVSS Score: 4.7

Product Status

Vendor getprobo
Product probo
Versions
  • Version < 0.193.1 is affected

References

Problem Types

  • CWE-601: URL Redirection to Untrusted Site ('Open Redirect') CWE