---
id: CVE-2024-41955
aliases:
  - GHSA-8m9j-2f32-2vx4
  - PYSEC-2026-1669
title: MobSF vulnerable to Open Redirect in Login Redirect
summary: MobSF vulnerable to Open Redirect in Login Redirect
severity: medium
cvss: 5.2
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:H/A:N'
vendor: mobsf
product: mobsf
ecosystem: pip
affected:
  - mobsf < 4.0.5
patched:
  - mobsf 4.0.5
published: '2024-07-31'
updated: '2026-07-07'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GHSA-8m9j-2f32-2vx4'
references:
  - url: >-
      https://github.com/MobSF/Mobile-Security-Framework-MobSF/security/advisories/GHSA-8m9j-2f32-2vx4
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2024-41955'
  - url: >-
      https://github.com/MobSF/Mobile-Security-Framework-MobSF/commit/fdaad81314f393d324c1ede79627e9d47986c8c8
  - url: 'https://github.com/MobSF/Mobile-Security-Framework-MobSF'
tags:
  - osv
  - pip
  - exploit-available
epss: 0.01
epssPercentile: 0.61217
ingestedAt: '2026-07-08T18:25:47.516Z'
exploits:
  nuclei:
    - CVE-2024-41955
  checkedAt: '2026-09-25T08:20:43.356Z'
exploitAvailable: true
---

## Overview

### Impact
_What kind of vulnerability is it? Who is impacted?_

An open redirect vulnerability exist in MobSF authentication view. 

PoC
1. Go to http://127.0.0.1:8000/login/?next=//afine.com in a web browser.
2. Enter credentials and press "Sign In".
3. You will be redirected to [afine.com](http://afine.com/)

Users who are not using authentication are not impacted.

### Patches
_Has the problem been patched? What versions should users upgrade to?_

Update to MobSF v4.0.5

### Workarounds
_Is there a way for users to fix or remediate the vulnerability without upgrading?_
Disable Authentication

### References
_Are there any links users can visit to find out more?_
Fix: https://github.com/MobSF/Mobile-Security-Framework-MobSF/commit/fdaad81314f393d324c1ede79627e9d47986c8c8

### Reporter
Marcin Węgłowski (AFINE Team)


## Affected packages

- `mobsf < 4.0.5`

## Remediation

Upgrade to a patched release:

- `mobsf 4.0.5`