AIKIDO-2025-10199
@payloadcms/next is vulnerable to Open Redirect
60
Medium Risk
This Affects:
@payloadcms/nextTL;DR
Affected versions of this package are vulnerable to an open redirect in the getSafeRedirect method due to improper input validation. The method fails to correctly escape, normalize, or encode URLs before processing redirects, allowing an attacker to craft a malicious URL that redirects users to phishing or malicious sites. This can deceive users into visiting unintended domains under the guise of a legitimate link.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range.
Background info
@payloadcms/next is vulnerable to Open Redirect in versions 3.31.0 - 3.31.0.
How to fix this
Upgrade the @payloadcms/next library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
SOC 2Compliant
ISO 27001Compliant