CVE-2021-21337

Products.PluggableAuthService is a pluggable Zope authentication and authorization framework. In Products.PluggableAuthService before version 2.6.0 there is an open redirect vulnerability. A maliciously crafted link to the login form and login functionality could redirect the browser to a different website. The problem has been fixed in version 2.6.1. Depending on how you have installed Products.PluggableAuthService, you should change the buildout version pin to `2.6.1` and re-run the buildout, or if you used `pip` simply do `pip install "Products.PluggableAuthService>=2.6.1".

• CWE-601

• http://packetstormsecurity.com/files/162911/Products.PluggableAuthService-2.6.0-Open-Redirect.htmlExploit, Third Party Advisory, VDB Entry
• https://github.com/zopefoundation/Products.PluggableAuthService/commit/7eead067898852ebd3e0f143bc51295928528dfaPatch, Third Party Advisory
• https://github.com/zopefoundation/Products.PluggableAuthService/security/advisories/GHSA-p44j-xrqg-4xrrThird Party Advisory
• https://pypi.org/project/Products.PluggableAuthService/Product, Third Party Advisory
• http://packetstormsecurity.com/files/162911/Products.PluggableAuthService-2.6.0-Open-Redirect.htmlExploit, Third Party Advisory, VDB Entry
• https://github.com/zopefoundation/Products.PluggableAuthService/commit/7eead067898852ebd3e0f143bc51295928528dfaPatch, Third Party Advisory
• https://github.com/zopefoundation/Products.PluggableAuthService/security/advisories/GHSA-p44j-xrqg-4xrrThird Party Advisory
• https://pypi.org/project/Products.PluggableAuthService/Product, Third Party Advisory

Published

Mar 8, 2021

Last Modified

Jun 17, 2026

Status

Modified

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-21331The Java client for the Datadog API before version 1.0.0-bet…3.3
• CVE-2021-21332Synapse is a Matrix reference homeserver written in python (…8.2
• CVE-2021-21333Synapse is a Matrix reference homeserver written in python (…6.1
• CVE-2021-21334In containerd (an industry-standard container runtime) befor…6.3
• CVE-2021-21335In the SPNEGO HTTP Authentication Module for nginx (spnego-h…9.8
• CVE-2021-21336Products.PluggableAuthService is a pluggable Zope authentica…6.5
• CVE-2021-21338TYPO3 is an open source PHP based web content management sys…6.1
• CVE-2021-21339TYPO3 is an open source PHP based web content management sys…7.5
• CVE-2021-2134Vulnerability in the Enterprise Manager for Fusion Middlewar…6.5
• CVE-2021-21340TYPO3 is an open source PHP based web content management sys…5.4
• CVE-2021-21341XStream is a Java library to serialize objects to XML and ba…7.5
• CVE-2021-21342XStream is a Java library to serialize objects to XML and ba…9.1