CVE-2025-65581

Severity: medium (CVSS 5.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-12-16 · updated 2026-10-13
Weakness: CWE-601

Description

An open redirect vulnerability exists in the Account module in Volosoft ABP Framework >= 5.1.0 and < 10.0.0-rc.2. Improper validation of the returnUrl parameter in the register function allows an attacker to redirect users to arbitrary external domains.

Affected products

Volosoft Abp: from 5.1.0 before 10.0.0; 10.0.0-rc1 — fixed in 10.0.0

How to fix

Upgrade to a fixed version: Volosoft Abp 10.0.0. Check the vendor advisory for mitigations.

References

https://github.com/abpframework/abp/commit/44a2dc14e933f3ce1ca93f9313d836694ab77d1d
https://github.com/abpframework/abp/commit/a01adc58464d278ca817c4bbb6cbce30f155d0d1

Get alerted when CVE-2025-65581 or the next vulnerability affects your stack