Read the docs
TI-2021-04476 Aliases CVE-2021-21377GHSA-g4rf-pc26-6hmr

Open Redirect in OMERO.web

Priority LOW 26CWE-601Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
Required
Attack complexity
Low
Impact type
Spoofing
Confidentiality · integrity · availability
Low · Low · None
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-601.

Summary

OMERO.web is open source Django-based software for managing microscopy imaging. OMERO.web before version 5.9.0 supports redirection to a given URL after performing login or switching the group context. These URLs are not validated, allowing redirection to untrusted sites. OMERO.web 5.9.0 adds URL validation before redirecting. External URLs are not considered valid, unless specified in the omero.web.redirect_allowed_hosts setting.

Why it matters now

EPSS 0.00826 57th percentileScored 2026-11-07
Fix Fixed omero-web (ome): 5.9.0omero-web (PyPI): 5.9.0

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
omeomero-webbefore 5.9.05.9.0Patch availableCNA
—omero-web (PyPI)before 5.9.05.9.0Patch availableGHSA-g4rf-pc26-6hmr
  • omero-web Vendorome Affected before 5.9.0 Fixed in 5.9.0 Patch available CNA
  • omero-web (PyPI) Vendor— Affected before 5.9.0 Fixed in 5.9.0 Patch available GHSA-g4rf-pc26-6hmr

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:openmicroscopy:omero.web:*:*:*:*:*:*:*:*before 5.9.0Vulnerableome
  • cpe:2.3:a:openmicroscopy:omero.web:*:*:*:*:*:*:*:* Versions before 5.9.0 Vulnerable ·ome

Remediation

  • Fix · CNA omero-web (ome) Fixed in 5.9.0
  • Fix · GHSA-g4rf-pc26-6hmr omero-web (PyPI) Fixed in 5.9.0 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-21377
  2. 2026-10-03 Alias added: GHSA-g4rf-pc26-6hmr

References

Patch 1

Advisory 5

Other 4

  • TI-2021-04475 Information Exposure in OMERO.web CVSS 3.1MEDIUM 6.5
  • TI-2020-06414 OMERO.web before 5.6.3 optionally allows sensitive data elements (e.g., a session key) to… CVSS 3.1MEDIUM 5.7

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences