CVE-2026-107718

A flaw was found in AdonisJS HTTP Server. The route URL generation helper fails to properly encode parameter values when constructing redirect destinations. A remote attacker can exploit this flaw by supplying a crafted path parameter starting with a forward slash, generating a scheme-relative external web address. This issue allows attackers to redirect users from a trusted application to a malicious external website, facilitating phishing attacks and the abuse of authentication workflows.

Red Hat rates the severity of this flaw as Moderate because exploitation requires a victim to follow a deceptive link and does not permit code execution or backend data exposure, instead facilitating phishing or credential interception via open redirection. Vulnerability to this issue depends on whether a deployed application specifically maps untrusted user input directly into the leading segment of a dynamically generated redirect path. Standard deployments that do not use client-supplied values for routing redirects are inherently unaffected.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.