Medium 4.3Published Sep 4, 2026

CVE-2026-85676Dub Open Redirect via Unrestricted redir_url Parameter

Updated under an hour ago (2026-10-19 08:00 UTC)

Does this affect you?

It affects dubinc dub. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for dubinc dub

Exploited in the last 30 days

Dub contains an open redirect vulnerability in the redir_url query parameter that is accepted on every short link without validation or domain allowlist enforcement. Attackers can append the redir_url parameter to any short link to redirect visitors to arbitrary external URLs through the trusted Dub domain, bypassing destination blacklists and potentially enabling phishing attacks with link cloaking enabled.

CVSS: 4.3 MEDIUM (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Weakness (CWE): CWE-601
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: VulnCheck
NVD analysis: Deferred
Record last updated: Sep 14, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

dubinc dub dubinc:dub (from the name)	through 73415cf5e6be13ce9adb7ba5e97474307db34a17	CNA record

References

https://github.com/dubinc/dub/issues/4337issue-tracking
https://github.com/dubinc/dubproduct
https://github.com/dubinc/dub/blob/73415cf5e6be13ce9adb7ba5e97474307db34a17/apps/web/lib/middleware/utils/get-final-url.tstechnical-description
https://www.vulncheck.com/advisories/dub-open-redirect-via-unrestricted-redir-url-parameterthird-party-advisory

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.