{"id":"CVE-2025-65581","title":"An open redirect vulnerability exists in the Account module in Volosoft ABP Framework >= 5.1.0 and < 10.0.0-rc.2","summary":"An open redirect vulnerability exists in the Account module in Volosoft ABP Framework >= 5.1.0 and < 10.0.0-rc.2. Improper validation of the returnUrl parameter in the register function allows an attacker to redirect users to arbitrary e…","severity":"medium","cvss":5.3,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","cwe":["CWE-601"],"vendor":"volosoft","product":"abp","affected":["abp >= 5.1.0, < 10.0.0","abp = 10.0.0"],"patched":["abp 10.0.0"],"published":"2025-12-16","updated":"2026-10-13","sourceUpdated":"2026-10-13T11:10:00.203","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2025-65581","references":[{"url":"https://github.com/abpframework/abp/commit/44a2dc14e933f3ce1ca93f9313d836694ab77d1d","label":"cve@mitre.org"},{"url":"https://github.com/abpframework/abp/commit/a01adc58464d278ca817c4bbb6cbce30f155d0d1","label":"cve@mitre.org"}],"tags":["nvd"],"epss":0.00278,"epssPercentile":0.18672,"ingestedAt":"2026-10-13T11:23:51.111Z","slug":"CVE-2025-65581","body":"## Overview\n\nAn open redirect vulnerability exists in the Account module in Volosoft ABP Framework >= 5.1.0 and < 10.0.0-rc.2. Improper validation of the returnUrl parameter in the register function allows an attacker to redirect users to arbitrary external domains.\n\n## Affected\n\n- `abp >= 5.1.0, < 10.0.0`\n- `abp = 10.0.0`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `abp 10.0.0`","depth":"sunlit","depthScore":29,"depthScoreParts":{"impact":29.2,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}