{"action":"Upgrade web2py to 3.1.1 or later.","affected":[{"fixed":"3.1.1","introduced":"0"}],"component":"web2py","cve_ids":["CVE-2026-25198"],"ecosystem":"PyPI","epss":0.00338,"exploited":false,"fixed_versions":["3.1.1"],"ghsa_id":"GHSA-rf8c-3f5p-xv45","id":"tcs_01M5KH56VDQPQH62D95ZYP5J6Z","modified_at":"2026-07-13T16:33:27.692399683Z","published_at":"2026-07-13T14:36:34.584653Z","references":["https://osv.dev/vulnerability/PYSEC-2026-3413","https://nvd.nist.gov/vuln/detail/CVE-2026-25198","https://github.com/web2py/web2py/commit/b4e1ddbd6d40fb30863f6263a67bcdf411a0c6df","https://github.com/web2py/web2py","https://github.com/web2py/web2py/releases","https://jvn.jp/en/jp/JVN46925341","https://web2py.com","https://pypi.org/project/web2py","https://github.com/advisories/GHSA-rf8c-3f5p-xv45"],"severity":{"label":"medium","score":4.7},"sources":[{"source":"osv","source_id":"PYSEC-2026-3413","url":"https://osv.dev/vulnerability/PYSEC-2026-3413"}],"summary":"web2py has an Open Redirect Vulnerability"}