CVE-2026-126947: Zipline before 4.5.0 Stored Open Redirect via POST /api/user/urls
Zipline before 4.5.0 contains a stored open redirect vulnerability that allows authenticated users to set arbitrary short URL destinations by abusing missing scheme validation in POST /api/user/urls. Attackers can store javascript: URIs or attacker-controlled URLs as destinations, causing visitors of the trusted short link to be redirected to phishing or malware pages.
Affected Software
Event History
Frequently Asked Questions
Who can create malicious short links?
An authenticated user can create them through POST /api/user/urls. Exploitation requires only low-privileged authenticated access and user interaction from someone who visits the resulting trusted short link.
What versions are affected?
Zipline versions before 4.5.0 are affected. The provided information does not state whether any particular deployment configuration changes exposure.
What should be prioritized if upgrading is not immediately possible?
Restrict access to authenticated URL-creation functionality to trusted users and review existing short-link destinations for javascript: URIs or attacker-controlled URLs. Links created through the affected endpoint may need to be removed or corrected.