Read the docs
TI-2021-04437 Aliases CVE-2021-21337GHSA-p44j-xrqg-4xrr

URL Redirection to Untrusted Site ('Open Redirect') in Products.PluggableAuthService

Priority LOW 38CWE-601Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Spoofing
Confidentiality · integrity · availability
Low · Low · None
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-601.

Summary

Products.PluggableAuthService is a pluggable Zope authentication and authorization framework. In Products.PluggableAuthService before version 2.6.0 there is an open redirect vulnerability. A maliciously crafted link to the login form and login functionality could redirect the browser to a different website. The problem has been fixed in version 2.6.1. Depending on how you have installed Products.PluggableAuthService, you should change the buildout version pin to `2.6.1` and re-run the buildout, or if you used `pip` simply do `pip install "Products.PluggableAuthService>=2.6.1".

Why it matters now

EPSS 0.08443 95th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed Products.PluggableAuthService (zopefoundation): 2.6.1Products.PluggableAuthService (PyPI): 2.6.1

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
zopefoundationProducts.PluggableAuthServicebefore 2.6.12.6.1Patch availableCNA
—Products.PluggableAuthService (PyPI)before 2.6.12.6.1Patch availableGHSA-p44j-xrqg-4xrr
  • Products.PluggableAuthService Vendorzopefoundation Affected before 2.6.1 Fixed in 2.6.1 Patch available CNA
  • Products.PluggableAuthService (PyPI) Vendor— Affected before 2.6.1 Fixed in 2.6.1 Patch available GHSA-p44j-xrqg-4xrr

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:zope:products.pluggableauthservice:*:*:*:*:*:*:*:*before 2.6.1Vulnerablezopefoundation
  • cpe:2.3:a:zope:products.pluggableauthservice:*:*:*:*:*:*:*:* Versions before 2.6.1 Vulnerable ·zopefoundation

Remediation

  • Fix · CNA Products.PluggableAuthService (zopefoundation) Fixed in 2.6.1
  • Fix · GHSA-p44j-xrqg-4xrr Products.PluggableAuthService (PyPI) Fixed in 2.6.1 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-21337
  2. 2026-10-03 Alias added: GHSA-p44j-xrqg-4xrr
  3. 2026-10-23 EPSS moved to the 95th–99th percentile
  4. 2026-10-25 EPSS moved to the 90th–95th percentile
  5. 2026-10-31 EPSS moved to the 95th–99th percentile

References

Exploit 1

Patch 1

Advisory 3

Other 3

  • TI-2021-04436 Exposure of Sensitive Information to an Unauthorized Actor in Products.PluggableAuthService ZODBRoleManager CVSS 3.1MEDIUM 6.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences