Open redirect in Phoenix.LiveView.validate_local_url!/2 via ASCII tab, LF and CR
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Active
- Attack complexity
- Low
- Attack requirements
- Present
- Impact type
- Spoofing
- Confidentiality · integrity · availability
- None · None · None
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-601.
Summary
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in phoenixframework phoenix_live_view allows an attacker to send a victim's browser to an origin of the attacker's choosing via a :to value containing ASCII tab, LF or CR. redirect/2 validates :to through the private validate_local_url!/2 in lib/phoenix_live_view.ex, which is intended to guarantee the target is a path within the application. It rejects a leading // and any backslash, but not ASCII tab, LF or CR. Browsers strip those three characters before parsing a URL, so a value such as /<TAB>/example.com passes validation as a path and is then resolved as the scheme-relative URL //example.com. The live navigation functions share the guard but are not affected, because the client expands their target against the current origin. push_patch/2 is also affected before 0.7.0, which is when that expansion was added. This issue affects phoenix_live_view: from 0.5.0 before 1.0.19, from 1.1.0-rc.0 before 1.1.33, and from 1.2.0-rc.0 before 1.2.9.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| phoenixframework | phoenix_live_view | 0.5.0 to before 1.0.19; 1.1.0-rc.0 to before 1.1.33; 1.2.0-rc.0 to before 1.2.9 | 1.0.19, 1.1.33, 1.2.9 | Patch available | CNA |
- phoenix_live_view Vendorphoenixframework Affected 0.5.0 to before 1.0.19; 1.1.0-rc.0 to before 1.1.33; 1.2.0-rc.0 to before 1.2.9 Fixed in 1.0.19, 1.1.33, 1.2.9 Patch available CNA
CPE names CNA · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:phoenixframework:phoenix_live_view:*:*:*:*:*:*:*:* | — | — | phoenixframework |
- cpe:2.3:a:phoenixframework:phoenix_live_view:*:*:*:*:*:*:*:* Versions — — ·phoenixframework
Remediation
- Fix · CNA phoenix_live_view (phoenixframework) Fixed in 1.0.19, 1.1.33, 1.2.9
Timeline
- 2026-10-02 Threatist record created from CVE-2026-64941
References
Patch 3
- https://github.com/phoenixframework/phoenix_live_view/commit/0b8c733133466912f81adecaea72b6712370242e
- https://github.com/phoenixframework/phoenix_live_view/commit/1c164f83df0bb922dfff9c60d125da5b0cfd6619
- https://github.com/phoenixframework/phoenix_live_view/commit/2068b304d71907064b159b6bc60c5ad85a876ecf
Advisory 1
More phoenixframework vulnerabilities
- TI-2026-40965 Improper check for unusual conditions in phoenixframework phoenix CVSS 4.0MEDIUM 6.3
- TI-2026-41931 Scheme validation bypass in Phoenix.LiveView.Utils leads to XSS via <.link> CVSS 4.0MEDIUM 5.1
- TI-2026-40964 Phoenix transports do not limit channel joins per connection, enabling process-exhaustion denial of service CVSS 4.0HIGH 8.7
- TI-2026-25181 Long-poll NDJSON body splitting causes unbounded memory allocation in Phoenix CVSS 4.0HIGH 8.7
- TI-2022-20955 socket/transport.ex in Phoenix before 1.6.14 mishandles check_origin wildcarding. CVSS 3.1HIGH 7.5
- TI-2017-14495 The Phoenix Framework versions 1.0.0 through 1.0.4, 1.1.0 through 1.1.6, 1.2.0, 1.2.2 and… CVSS 3.0MEDIUM 6.1
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences