CVE-2026-54770

The CVSS 6.1 rating for CVE-2026-54770 fundamentally misrepresents actual risk in production environments where WebOb powers OAuth or SSO flows. The 'user interaction required' caveat masks a class of attacks where the victim has already committed trust before the redirect fires—the user is authenticated and has authorized the application, then the redirect happens automatically, sending cookies, session tokens, or authorization codes to the attacker's server with no additional click required. In OAuth flows, trust is highest precisely when the redirect executes. The vulnerability is a normalization-before-validation flaw. WebOb checks URL safety using SCHEME_RE regex and startswith('//') checks, but these validations run against the raw input before normalization occurs. An attacker can craft a URL that passes these checks but normalizes to a different, attacker-controlled destination. The existence of these validation methods in the API creates a dangerous false signal—developers who see the checks assume the library handles safety, precisely the assumption security-conscious developers would make. The applications most likely to skip their own additional validation are exactly the ones that read the docs, saw the checks, and concluded 'WebOb handles this.' This inverts the normal expectation about who gets burned by library quirks: careful developers are misled more than careless ones. This flaw belongs to a well-documented genetic lineage. The 'check before normalize' pattern has appeared in path traversal via double encoding, HTTP request smuggling, header injection, and prior URL redirect vulnerabilities. The fix—normalize before validating—is the same solution applied to every prior instance. WebOb's vulnerability is not novel in mechanism; it's a cross-contamination event where a library far from the OAuth domain accidentally reproduced an attack pattern the OAuth security community mapped years ago (similar to CVE-2018-1000407 in oauthlib). Real-world blast radius extends well beyond applications directly calling redirect methods. Pyram Framework and Pylons bundle WebOb as a transitive dependency, exposing applications that never explicitly use the vulnerable methods. More critically, frozen requirements files, internal vendor forks, and appliance-bundled copies create 'zombie exposure'—forgotten WebOb instances that will never receive this patch. Security scanners flag known CVEs in pinned versions, but they miss modified internal forks or stripped comments that match vendor coding styles. The EPSS prediction of 0.00344 captures known vulnerability in maintained codebases but systematically undercounts this forgotten population. Verify whether your application performs any URL validation before calling Response._make_location_absolute, Request.relative_url(), or HTTPFound/redirect methods. If you assumed WebOb's built-in checks were sufficient, add explicit post-normalization validation in your application layer. If you use WebOb through Pyramid or Pylons, confirm what version the framework bundles and whether you can override it. Prioritize auditing any authenticated flows that issue redirects—these are the highest-value targets where exploitation requires no additional user action beyond the authorization they already completed.

Reviewed through automated stages and approved by a human before publication.