medium5.3
CVE-2025-65581
ABP Account Module has an Open Redirect through Improper validation in its register function
Impact
An open redirect vulnerability exists in the Account module in Volosoft ABP Framework >= 5.1.0 and < 10.0.0-rc.2. Improper validation of the returnUrl parameter in the register function allows an attacker to redirect users to arbitrary external domains.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| nuget | Volo.Abp.Account.Web | >= 5.1.0, < 10.0.0-rc.2 | 10.0.0-rc.2 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Volosoft | Abp | from 5.1.0 before 10.0.0 Version 10.0.0 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/abpframework/abp/commit/44a2dc14e933f3ce1ca93f9313d836694ab77d1d
- https://github.com/abpframework/abp/commit/a01adc58464d278ca817c4bbb6cbce30f155d0d1
- https://github.com/advisories/GHSA-vfm5-cr22-jg3m
- https://nvd.nist.gov/vuln/detail/CVE-2025-65581