CVE-2025-34440: AVideo < 20.1 Open Redirect via siteRedirectUri Parameter
AVideo versions prior to 20.1 contain an open redirect vulnerability caused by insufficient validation of the siteRedirectUri parameter during user registration. Attackers can redirect users to external sites, facilitating phishing attacks.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
AVideoto a version that resolves this vulnerability.Fixed in 20.1 - Configuration
Validate and sanitize the siteRedirectUri parameter during user registration so that it cannot point to external sites (e.g., accept only relative paths or compare against a whitelist of allowed internal domains) to prevent open redirects.
AVideo siteRedirectUri = only allow relative URLs or whitelist internal domains
Event History
Frequently Asked Questions
What is the severity of CVE-2025-34440?
CVE-2025-34440 is classified as a high severity vulnerability due to its potential for facilitating phishing attacks.
How do I fix CVE-2025-34440?
To mitigate CVE-2025-34440, upgrade AVideo to version 20.0 or later, which addresses the open redirect vulnerability.
What systems are affected by CVE-2025-34440?
CVE-2025-34440 affects AVideo versions prior to 20.0.
What is the nature of the vulnerability described in CVE-2025-34440?
CVE-2025-34440 is an open redirect vulnerability resulting from inadequate validation of the siteRedirectUri parameter during user registration.
What risks are associated with CVE-2025-34440?
The primary risk associated with CVE-2025-34440 is that attackers can redirect users to malicious external sites, leading to potential phishing attacks.