Riskcovery

CVE-2026-64941

Open redirect in Phoenix.LiveView.validate_local_url!/2 via ASCII tab, LF and CR

State
Published
Severity
2.1 Low
Published
Aug 10, 2026
Updated
Aug 10, 2026
Reserved
Aug 9, 2026

Read the record on cve.org

Description

URL Redirection to Untrusted Site ('Open Redirect') vulnerability in phoenixframework phoenix_live_view allows an attacker to send a victim's browser to an origin of the attacker's choosing via a :to value containing ASCII tab, LF or CR.

redirect/2 validates :to through the private validate_local_url!/2 in lib/phoenix_live_view.ex, which is intended to guarantee the target is a path within the application. It rejects a leading // and any backslash, but not ASCII tab, LF or CR. Browsers strip those three characters before parsing a URL, so a value such as /<TAB>/example.com passes validation as a path and is then resolved as the scheme-relative URL //example.com. The live navigation functions share the guard but are not affected, because the client expands their target against the current origin. push_patch/2 is also affected before 0.7.0, which is when that expansion was added.

This issue affects phoenix_live_view: from 0.5.0 before 1.0.19, from 1.1.0-rc.0 before 1.1.33, and from 1.2.0-rc.0 before 1.2.9.

Scores

CVSSScoreVectorSource
4.02.1 LowCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:NEEF

Weaknesses

  • CWE-601 URL Redirection to Untrusted Site ('Open Redirect')

Affected Products

ProductVersions
phoenix_live_viewphoenixframework
  • 0.5.0 to before 1.0.19Affected
  • 1.1.0-rc.0 to before 1.1.33Affected
  • 1.2.0-rc.0 to before 1.2.9Affected
phoenix_live_viewphoenixframework
  • b20dba3f65a380b2e4868dae03397f13d2daa070 and laterAffectedfrom 0b8c733133466912f81adecaea72b6712370242eNot affectedfrom 1c164f83df0bb922dfff9c60d125da5b0cfd6619Not affectedfrom 2068b304d71907064b159b6bc60c5ad85a876ecfNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.