{"action":"Upgrade web2py to 3.1.1 or later.","affected":[{"fixed":"3.1.1","introduced":"0"}],"component":"web2py","cve_ids":["CVE-2026-25198"],"ecosystem":"PyPI","epss":0.00343,"exploited":false,"fixed_versions":["3.1.1"],"ghsa_id":"GHSA-rf8c-3f5p-xv45","id":"tcs_01M5KFXVFGJ17GTQMPCJYP0QF5","modified_at":"2026-07-13T16:43:36.759351659Z","published_at":"2026-02-05T09:31:13Z","references":["https://osv.dev/vulnerability/GHSA-rf8c-3f5p-xv45","https://nvd.nist.gov/vuln/detail/CVE-2026-25198","https://github.com/web2py/web2py/commit/b4e1ddbd6d40fb30863f6263a67bcdf411a0c6df","https://github.com/web2py/web2py","https://github.com/web2py/web2py/releases","https://jvn.jp/en/jp/JVN46925341","https://web2py.com"],"severity":{"label":"medium","score":4.7},"sources":[{"source":"osv","source_id":"GHSA-rf8c-3f5p-xv45","url":"https://osv.dev/vulnerability/GHSA-rf8c-3f5p-xv45"}],"summary":"web2py has an Open Redirect Vulnerability"}