CVE-2026-49820

Probo is a self-hostable governance, risk, and compliance (GRC) platform built for engineering and security teams. Probo's `saferedirect` package validates redirect URLs used across authentication flows (OIDC, SAML, session transfer, OAuth connectors, and trust-center magic links). Prior to version 0.19.3.1, the validator only inspected the second character of relative paths, so a URL like `/../\evil.com` passed validation because the second character is `.`. Go's `http.Redirect` normalizes this path to `/\evil.com` before setting the `Location` header. Browsers can interpret the backslash as a host separator and redirect the user to an external domain (`https://evil.com`), bypassing the intended same-origin restriction. This enables open-redirect phishing: an attacker can craft a `continue` parameter (or embed a malicious URL in a session-transfer token) that appears to originate from a trusted Probo domain but redirects victims elsewhere. This is fixed in `go.probo.inc/probo` 0.193.1 by normalizing relative paths with `path.Clean` before validation, rejecting backslashes (including percent-encoded `%5c`) anywhere in the path, and re-checking the normalized result for protocol-relative and backslash prefixes. Self-hosted deployments should upgrade to probod v0.194.1 or later. SaaS deployments on getprobo.com are patched. No practical workaround is available for self-hosted installations.

• CWE-601

• https://github.com/getprobo/probo/blob/main/SECURITY_NOTES.md
• https://github.com/getprobo/probo/security/advisories/GHSA-x7qq-m748-8p2c

Published

Aug 13, 2026

Last Modified

Sep 18, 2026

Status

Deferred

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-49815Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.7,…7.2
• CVE-2026-49816Dell Command Update (DCU), versions prior to 5.7.1, contain …7.8
• CVE-2026-49817Dell Command Update (DCU), versions prior to 5.7.1, contain …7.8
• CVE-2026-49818The Apache Airflow Samba provider's `GCSToSambaOperator` joi…6.5
• CVE-2026-49819UpSnap is a wake on lan web app. Versions 4.4.1 through 5.3.…9.8
• CVE-2026-4982A user with permission "update world" in any Venueless world…7.3
• CVE-2026-49821Fission is an open-source, Kubernetes-native serverless fram…7.7
• CVE-2026-49822Fission is an open-source, Kubernetes-native serverless fram…7.7
• CVE-2026-49823Fission is an open-source, Kubernetes-native serverless fram…7.7
• CVE-2026-49824Fission is an open-source, Kubernetes-native serverless fram…8.5
• CVE-2026-49825lxml is a library for processing XML and HTML in the Python …8.2
• CVE-2026-49826Concourse is a container-based automation system written in …0