CVE-2026-54770 Pylons CVE debrief

Who should care

Defenders and developers using the WebOb library should assess their exposure and apply the patch or compensating controls. This includes reviewing the library version used in their application, verifying the patch is applied or compensating controls are in place, and monitoring for potential phishing or OAuth and SSO token theft attempts. Security teams and vulnerability management teams should also be aware of this vulnerability and prioritize its remedi

Why it matters

CVE-2026-54770 is a medium-severity vulnerability in the WebOb library that can lead to phishing or OAuth and SSO token theft if exploited. Defenders and developers should assess exposure and apply the patch or compensating controls.

• Phishing or OAuth and SSO token theft attempts may occur if users follow the redirect
• Defenders should verify the patch is applied or compensating controls are in place
• Exposure requires verification from official sources
• Remediation priority is medium due to the potential impact

Technical summary

The WebOb library is vulnerable to a redirect vulnerability prior to version 1.8.11. An attacker-controlled value can bypass checks and be normalized to an off-host redirect, potentially leading to phishing or OAuth and SSO token theft. The vulnerability arises from the Response._make_location_absolute() function in src/webob/response.py, which does not properly handle Location values. This allows an attacker to influence the redirect target and send users to an attacker-controlled host. The issue is fixed in version 1.8.11, and defenders should assess their exposure and apply the patch or compensating controls.

Defensive priority

Medium

Recommended defensive actions

• Review and apply the patch in version 1.8.11
• Assess exposure and apply compensating controls if patching is not feasible
• Monitor for potential phishing or OAuth and SSO token theft attempts
• Verify the WebOb library version used in the application
• Check for any existing redirects that could be exploited
• Implement additional security measures to detect and prevent phishing attempts
• Track exceptions and retest remediated assets to ensure the vulnerability is fully resolved

Evidence notes

The CVE record and NVD entry provide details on the WebOb redirect vulnerability. The issue is fixed in version 1.8.11. To verify, defenders should check if the WebOb library version used in their application is 1.8.11 or later. The vulnerability allows an attacker-controlled value to bypass SCHEME_RE and startswith('//') checks, potentially leading to phishing or OAuth and SSO token theft. Official sources, including the CVE Program and NVD, confirm the vulnerability and provide guidance on remediation.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.