MEDIUM6.1

PYSEC-2026-1064

Open redirect in web2py

Quick fix

PYSEC-2026-1064 — web2py: upgrade to the fixed version with the command below.

pip install --upgrade 'web2py>=2.23.1'

Details

Open redirect vulnerability exists in web2py versions prior to 2.23.1. When using the tool, a web2py user may be redirected to an arbitrary website by accessing a specially crafted URL. As a result, the user may become a victim of a phishing attack.

Are you affected?

Enter the version of the package you're using.

Affected packages

PyPI/web2py

Introduced in: 0Fixed in: 2.23.1

Fixpip install --upgrade 'web2py>=2.23.1'

References

https://nvd.nist.gov/vuln/detail/CVE-2023-22432[ADVISORY]
https://jvn.jp/en/jp/JVN78253670[WEB]
http://web2py.com[WEB]
http://web2py.com/init/default/download[WEB]
https://pypi.org/project/web2py[PACKAGE]
https://github.com/advisories/GHSA-w4r7-vm83-q2c7[ADVISORY]