Tornado: Open redirect in RedirectHandler via protocol-relative URLs

影響: pip:tornado < 6.6 → 6.6

tornado.web.RedirectHandler builds its target URL by substituting parts of the request path into a template. Depending on where those substitutions appear in the template, an attacker can craft a request that redirects to a host of their choosing. This creates an open redirect on the application's domain, which can be used in phishing. Impact Applications are affected if they use RedirectHandler with a URL template where a regex capture group can influence the scheme or host of the redirect. Th…

Read on GitHub Advisory Database

On 10/29/2026, 07:43 AM, GitHub Advisory Database published "Tornado: Open redirect in RedirectHandler via protocol-relative URLs" (type: Advisory). Severity is "Low" (low). Related technologies: Python. CVE: CVE-2026-116578.