CVE-2023-35948

Novu provides an API for sending notifications through multiple channels. Versions prior to 0.16.0 contain an open redirect vulnerability in the "Sign In with GitHub" functionality of Novu's open-source repository. It could have allowed an attacker to force a victim into opening a malicious URL and thus, potentially log into the repository under the victim's account gaining full control of the account. This vulnerability only affected the Novu Cloud and Open-Source deployments if the user manually enabled the GitHub OAuth on their self-hosted instance of Novu. Users should upgrade to version 0.16.0 to receive a patch.

• CWE-601

• https://github.com/novuhq/novu/pull/3510Patch
• https://github.com/novuhq/novu/security/advisories/GHSA-xxv3-m43w-gv79Vendor Advisory
• https://github.com/novuhq/novu/pull/3510Patch
• https://github.com/novuhq/novu/security/advisories/GHSA-xxv3-m43w-gv79Vendor Advisory

Published

Jul 6, 2023

Last Modified

Jun 17, 2026

Status

Modified

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-35942Envoy is an open source edge and service proxy designed for …6.5
• CVE-2023-35943Envoy is an open source edge and service proxy designed for …7.5
• CVE-2023-35944Envoy is an open source edge and service proxy designed for …5.3
• CVE-2023-35945Envoy is a cloud-native high-performance edge/middle/service…7.5
• CVE-2023-35946Gradle is a build tool with a focus on build automation and …5.5
• CVE-2023-35947Gradle is a build tool with a focus on build automation and …8.1
• CVE-2023-35949Multiple stack-based buffer overflow vulnerabilities exist i…7.8
• CVE-2023-3595 Where this vulnerability exists in the Rockwell Automation …9.8
• CVE-2023-35950Multiple stack-based buffer overflow vulnerabilities exist i…7.8
• CVE-2023-35951Multiple stack-based buffer overflow vulnerabilities exist i…7.8
• CVE-2023-35952Multiple stack-based buffer overflow vulnerabilities exist i…7.8
• CVE-2023-35953Multiple stack-based buffer overflow vulnerabilities exist i…7.8