medium · CVSS v3 6.1 · CVSS v4 5.1
CVE-2026-111754
Angular platform-server SSR is vulnerable to an open redirect via protocol-relative URLs, allowing attackers to redirect users to malicious
Overview
Angular platform-server SSR is vulnerable to an open redirect via protocol-relative URLs, allowing attackers to redirect users to malicious sites. The flaw can be exploited by manipulating URLs rendered on the server side. It is relevant for any Angular SSR deployment that does not sanitize or validate URLs.
Description
@angular/platform-server: Open Redirect via Protocol-Relative URLs in Server-Side Rendering (SSR)
Impact
The vulnerability compromises confidentiality by enabling phishing attacks, integrity by potentially redirecting users to malicious content, and availability if users are directed to resource-intensive sites. Web applications built with Angular SSR and their end users are directly impacted.
Remediation
Update Angular to the latest version that includes the SSR redirect fix. Sanitize and validate all URLs on the server side, rejecting protocol-relative URLs or enforcing a whitelist of allowed domains. Implement strict transport security (HSTS) and consider adding a redirect validation middleware.
Risk context
Medium severity (CVSS 6.1) with no EPSS data. The risk is moderate; defenders should prioritize patching and input validation to mitigate potential phishing or credential theft.
Affected products
- Angular platform-server
Scores
- Severity
- medium
- CVSS v2
- 5.8
- CVSS v3
- 6.1
- CVSS v4
- 5.1
- EPSS
- —