CVE-2025-71405
go-chi chi before v5.2.2 Open Redirect via RedirectSlashes
- State
- Published
- Severity
- 5.1 Medium
- Published
- Aug 14, 2026
- Updated
- Oct 8, 2026
- Reserved
- Jul 18, 2026
Description
chi versions before v5.2.2 contain an open redirect vulnerability in the RedirectSlashes middleware function that uses the Host header to construct redirect URLs. Attackers can manipulate the Host header to redirect users to arbitrary hosts, enabling phishing attacks and credential theft.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 5.1 Medium | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N | VulnCheck |
Weaknesses
- CWE-601 URL Redirection to Untrusted Site ('Open Redirect')
Affected Products
| Product | Versions |
|---|---|
chigo-chi |
|
References
- GitHub Security Advisory (GHSA-vrw8-fxc6-2r93)vendor-advisory
- VulnCheck Advisory: go-chi chi before v5.2.2 Open Redirect via RedirectSlashesthird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.