WebOb, a library for handling HTTP requests and responses, normalizes the Location header when issuing a redirect by joining the target to the request URI with Python's urljoin. Prior to version 1.8.10, this process is vulnerable to an open redirect. A redirect target containing ASCII tab, carriage return, or newline characters can be misinterpreted as a protocol‑relative URL, causing the resulting authority component to be an attacker‑controlled host. This flaw bypasses a previous fix that escaped leading double slashes and allows an attacker who can influence the redirect location to send users to an arbitrary external site instead of the intended destination, posing a phishing and credential‑re‑use risk.

The vulnerability affects the WebOb component of the Pylons project. All installations of WebOb with a version earlier than 1.8.10 are susceptible; versions 1.8.10 and later incorporate the fix.

The CVSS score of 6.1 indicates a moderate severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting no known widespread exploitation at this time. An attacker would need a context where they can control or influence the Location header sent in a WebOb response—such as by compromising a web application that uses WebOb—making the attack likely to be domain‑specific rather than broad.