CVE-2025-65581

Medium · 5.3

CVSS

5.3

EPSS

0.3%

Published

Dec 16, 2025

CISA due date

—

The record

An open redirect vulnerability exists in the Account module in Volosoft ABP Framework >= 5.1.0 and < 10.0.0-rc.2. Improper validation of the returnUrl parameter in the register function allows an attacker to redirect users to arbitrary external domains.

Affected packages

Ecosystem	Package	Introduced	Fixed
NuGet	Volo.Abp.Account.Web	5.1.0	10.0.0-rc.2
nuget	Volo.Abp.Account.Web	5.1.0	10.0.0-rc.2

Related vulnerabilities

GHSA-vfm5-cr22-jg3m ABP Account Module has an Open Redirect through Improper validation in its register… Same vulnerability