CVE-2025-65581: Input Validation
An open redirect vulnerability exists in the Account module in Volosoft ABP Framework >= 5.1.0 and < 10.0.0-rc.2. Improper validation of the returnUrl parameter in the register function allows an attacker to redirect users to arbitrary external domains.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
nuget/Volo.Abp.Account.Webto a version that resolves this vulnerability.Fixed in 10.0.0-rc.2
Event History
Frequently Asked Questions
What is the severity of CVE-2025-65581?
CVE-2025-65581 is classified as a medium risk vulnerability due to the potential for user redirection to malicious external sites.
How do I fix CVE-2025-65581?
To fix CVE-2025-65581, update to Volosoft ABP Framework version 10.0.0-rc.2 or later.
What causes CVE-2025-65581?
CVE-2025-65581 is caused by improper validation of the returnUrl parameter in the register function of the Account module.
Which versions of Volosoft ABP Framework are affected by CVE-2025-65581?
CVE-2025-65581 affects Volosoft ABP Framework versions from 5.1.0 to below 10.0.0-rc.2.
What impact does CVE-2025-65581 have on users?
CVE-2025-65581 allows attackers to redirect users to arbitrary external domains, potentially leading to phishing or malicious content.