CVE-2026-114060: SvelteKit before 3.0.0 Open Redirect via Enhanced Form Actions

Q: Which applications are exposed to this issue?

Applications using @sveltejs/kit before 3.0.0 are exposed when they use enhanced form actions (use:enhance) on routes that accept action paths beginning with a double slash.

Q: What must an attacker do to exploit it?

An attacker must craft an action path starting with // and induce a victim to interact with the enhanced form action. The double slash is interpreted as a protocol-relative URL, allowing navigation to an attacker-controlled site.

Q: Is user interaction required?

Yes. The affected form result must cause the victim's browser to navigate, so exploitation requires victim interaction.

Published Oct 21, 2026

Updated

SvelteKit (@sveltejs/kit) before 3.0.0 contains an open redirect vulnerability in enhanced form actions (use:enhance) on routes accepting paths beginning with a double slash. Attackers can craft action paths starting with // that become protocol-relative URLs, causing non-redirect form results to navigate victims to attacker-controlled sites.

Affected Software

1 affected component

npm/@sveltejs/kit<3.0.0

Event History

Oct 21, 2026

CVE Published

via MITRE·12:36 AM

Data Sourced

via MITRE·12:36 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Which applications are exposed to this issue?

Applications using @sveltejs/kit before 3.0.0 are exposed when they use enhanced form actions (use:enhance) on routes that accept action paths beginning with a double slash.

What must an attacker do to exploit it?

An attacker must craft an action path starting with // and induce a victim to interact with the enhanced form action. The double slash is interpreted as a protocol-relative URL, allowing navigation to an attacker-controlled site.

Is user interaction required?

Yes. The affected form result must cause the victim's browser to navigate, so exploitation requires victim interaction.

CVE-2026-114060: SvelteKit before 3.0.0 Open Redirect via Enhanced Form Actions

Affected Software

Event History

Frequently Asked Questions

Which applications are exposed to this issue?

What must an attacker do to exploit it?

Is user interaction required?

Company

Resources

Contact

Frequently Asked Questions

Which applications are exposed to this issue?

What must an attacker do to exploit it?

Is user interaction required?