---
id: CVE-2023-22432
aliases:
  - GHSA-w4r7-vm83-q2c7
  - PYSEC-2026-1064
title: Open redirect in web2py
summary: Open redirect in web2py
severity: medium
cvss: 6.1
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N'
vendor: web2py
product: web2py
ecosystem: pip
affected:
  - web2py < 2.23.1
patched:
  - web2py 2.23.1
published: '2023-03-06'
updated: '2026-07-07'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GHSA-w4r7-vm83-q2c7'
references:
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2023-22432'
  - url: 'https://jvn.jp/en/jp/JVN78253670'
  - url: 'http://web2py.com'
  - url: 'http://web2py.com/init/default/download'
tags:
  - osv
  - pip
  - exploit-available
epss: 0.02402
epssPercentile: 0.8334
ingestedAt: '2026-07-08T18:25:53.548Z'
exploits:
  github: 1
  githubRepos:
    - 'https://github.com/aeyesec/CVE-2023-22432'
  nuclei:
    - CVE-2023-22432
  checkedAt: '2026-09-26T09:05:29.616Z'
exploitAvailable: true
---

## Overview

Open redirect vulnerability exists in web2py versions prior to 2.23.1. When using the tool, a web2py user may be redirected to an arbitrary website by accessing a specially crafted URL. As a result, the user may become a victim of a phishing attack.

## Affected packages

- `web2py < 2.23.1`

## Remediation

Upgrade to a patched release:

- `web2py 2.23.1`