CVE-2026-64941
Description
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in phoenixframework phoenix_live_view allows an attacker to send a victim's browser to an origin of the attacker's choosing via a :to value containing ASCII tab, LF or CR. redirect/2 validates :to through the private validate_local_url!/2 in lib/phoenix_live_view.ex, which is intended to guarantee the target is a path within the application. It rejects a leading // and any backslash, but not ASCII tab, LF or CR. Browsers strip those three characters before parsing a URL, so a value such as /<TAB>/example.com passes validation as a path and is then resolved as the scheme-relative URL //example.com. The live navigation functions share the guard but are not affected, because the client expands their target against the current origin. push_patch/2 is also affected before 0.7.0, which is when that expansion was added. This issue affects phoenix_live_view: from 0.5.0 before 1.0.19, from 1.1.0-rc.0 before 1.1.33, and from 1.2.0-rc.0 before 1.2.9.
How to fix
- phoenixframework phoenix_live_view1.0.19, 1.1.33, 1.2.9 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| phoenixframework phoenix_live_view | 0.5.0 ≤ v < 1.0.19, 1.1.0-rc.0 ≤ v < 1.1.33, 1.2.0-rc.0 ≤ v < 1.2.9, b20dba3f65a380b2e4868dae03397f13d2daa070 | 1.0.19, 1.1.33, 1.2.9 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.