Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-85676— Dub Open Redirect via Unrestricted redir_url Parameter

Quick assessment

Affected
dubinc dub
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Dub 在 查询参数中存在一个开放重定向漏洞。该参数可被附加到任意短链接上，且未经验证，也未强制执行域名白名单。攻击者可以将 参数添加到任何短链接中，从而通过受信任的 Dub 域名将访客重定向到任意外部 URL，绕过目标黑名单，并在启用链接隐藏（link cloaking）功能时，可能引发钓鱼攻击。

CVSS 4.3 · Medium EPSS 0.24% · P15

Affected Version Matrix 1

VendorProduct Version RangeStatus
dubinc dub ≤ 73415cf5e6be13ce9adb7ba5e97474307db34a17 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-85676

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Dub Open Redirect via Unrestricted redir_url Parameter
Source: CVE Program / CVE List V5
Vulnerability Description
Dub contains an open redirect vulnerability in the redir_url query parameter that is accepted on every short link without validation or domain allowlist enforcement. Attackers can append the redir_url parameter to any short link to redirect visitors to arbitrary external URLs through the trusted Dub domain, bypassing destination blacklists and potentially enabling phishing attacks with link cloaking enabled.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
指向未可信站点的URL重定向(开放重定向)
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
dubinc dub 0 ~ 73415cf5e6be13ce9adb7ba5e97474307db34a17 -

II. Public POCs for CVE-2026-85676

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-85676

请登录查看更多情报信息。

Vendor Advisories for CVE-2026-85676 (1)

Proof of Concept for CVE-2026-85676 (1)

Other References for CVE-2026-85676 (1)

IV. Related Vulnerabilities

Same product: dub
Same weakness: CWE-601

V. Comments for CVE-2026-85676

No comments yet

Leave a comment