CVE-2026-85676: Dub Open Redirect via Unrestricted redir_url Parameter
Dub contains an open redirect vulnerability in the redirurl query parameter that is accepted on every short link without validation or domain allowlist enforcement. Attackers can append the redirurl parameter to any short link to redirect visitors to arbitrary external URLs through the trusted Dub domain, bypassing destination blacklists and potentially enabling phishing attacks with link cloaking enabled.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Anyone who follows a Dub short link can be redirected to an attacker-controlled external site if the link includes a crafted redir_url parameter. The issue is particularly relevant where recipients trust the Dub domain or where link cloaking is enabled.
What does an attacker need to exploit it?
An attacker needs a Dub short link and can append an arbitrary redir_url query parameter. No authentication or other privileges are required, but a victim must follow the crafted link.
Are default deployments affected?
The redir_url parameter is described as being accepted on every short link without validation or domain allowlist enforcement. Based on the available information, exposure does not depend on a configured destination allowlist.
How can I determine whether an instance is affected?
Test a Dub short link with a redir_url query parameter pointing to an external domain and observe whether the visitor is redirected there. An affected instance permits the external redirect rather than validating or restricting the destination.