---
id: CVE-2025-65581
title: >-
  An open redirect vulnerability exists in the Account module in Volosoft ABP
  Framework >= 5.1.0 and < 10.0.0-rc.2
summary: >-
  An open redirect vulnerability exists in the Account module in Volosoft ABP
  Framework >= 5.1.0 and < 10.0.0-rc.2. Improper validation of the returnUrl
  parameter in the register function allows an attacker to redirect users to
  arbitrary e…
severity: medium
cvss: 5.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L'
cwe:
  - CWE-601
vendor: volosoft
product: abp
affected:
  - 'abp >= 5.1.0, < 10.0.0'
  - abp = 10.0.0
patched:
  - abp 10.0.0
published: '2025-12-16'
updated: '2026-10-13'
sourceUpdated: '2026-10-13T11:10:00.203'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2025-65581'
references:
  - url: >-
      https://github.com/abpframework/abp/commit/44a2dc14e933f3ce1ca93f9313d836694ab77d1d
    label: cve@mitre.org
  - url: >-
      https://github.com/abpframework/abp/commit/a01adc58464d278ca817c4bbb6cbce30f155d0d1
    label: cve@mitre.org
tags:
  - nvd
epss: 0.00278
epssPercentile: 0.18672
ingestedAt: '2026-10-13T11:23:51.111Z'
---

## Overview

An open redirect vulnerability exists in the Account module in Volosoft ABP Framework >= 5.1.0 and < 10.0.0-rc.2. Improper validation of the returnUrl parameter in the register function allows an attacker to redirect users to arbitrary external domains.

## Affected

- `abp >= 5.1.0, < 10.0.0`
- `abp = 10.0.0`

## Remediation

Upgrade past the affected range:

- `abp 10.0.0`