---
id: CVE-2017-7266
aliases:
  - GHSA-j6jq-3q8p-xgg6
  - PYSEC-2026-919
title: Netflix Security Monkey Open Redirect vulnerability
summary: Netflix Security Monkey Open Redirect vulnerability
severity: medium
cvss: 6.1
cvssVector: 'CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N'
vendor: security-monkey
product: security-monkey
ecosystem: pip
affected:
  - security-monkey < 0.8.0
patched:
  - security-monkey 0.8.0
published: '2022-05-17'
updated: '2026-07-07'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GHSA-j6jq-3q8p-xgg6'
references:
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2017-7266'
  - url: 'https://github.com/Netflix/security_monkey/pull/482'
  - url: >-
      https://github.com/Netflix/security_monkey/commit/3b4da13efabb05970c80f464a50d3c1c12262466
  - url: 'https://github.com/Netflix/security_monkey'
  - url: 'https://github.com/Netflix/security_monkey/releases/tag/v0.8.0'
  - url: >-
      https://web.archive.org/web/20201220170714/http://www.securityfocus.com/bid/97088
tags:
  - osv
  - pip
epss: 0.01115
epssPercentile: 0.64107
ingestedAt: '2026-07-08T18:25:50.597Z'
---

## Overview

Netflix Security Monkey before 0.8.0 has an Open Redirect. The logout functionality accepted the "next" parameter which then redirects to any domain irrespective of the Host header.

## Affected packages

- `security-monkey < 0.8.0`

## Remediation

Upgrade to a patched release:

- `security-monkey 0.8.0`