Moderate severityOSV Advisory· Published Dec 16, 2025· Updated Dec 16, 2025
CVE-2025-65581
CVE-2025-65581
Description
An open redirect vulnerability exists in the Account module in Volosoft ABP Framework >= 5.1.0 and < 10.0.0-rc.2. Improper validation of the returnUrl parameter in the register function allows an attacker to redirect users to arbitrary external domains.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
Volo.Abp.Account.WebNuGet | >= 5.1.0, < 10.0.0-rc.2 | 10.0.0-rc.2 |
Affected products
1Patches
21 file changed · +1 −1
modules/account/src/Volo.Abp.Account.Web/Pages/Account/Register.cshtml.cs+1 −1 modified@@ -137,7 +137,7 @@ public virtual async Task<IActionResult> OnPostAsync() await RegisterLocalUserAsync(); } - return await RedirectSafelyAsync(ReturnUrl ?? "~/"); + return await RedirectSafelyAsync(ReturnUrl, ReturnUrlHash); } catch (BusinessException e) {
a01adc58464dUse safe redirect after registration
1 file changed · +1 −1
modules/account/src/Volo.Abp.Account.Web/Pages/Account/Register.cshtml.cs+1 −1 modified@@ -137,7 +137,7 @@ public virtual async Task<IActionResult> OnPostAsync() await RegisterLocalUserAsync(); } - return Redirect(ReturnUrl ?? "~/"); //TODO: How to ensure safety? IdentityServer requires it however it should be checked somehow! + return await RedirectSafelyAsync(ReturnUrl ?? "~/"); } catch (BusinessException e) {
Vulnerability mechanics
Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.
References
4News mentions
0No linked articles in our index yet.