WebOb's Response._make_location_absolute() inspects the Location header before normalizing it. The function first checks for a URI scheme or a double slash (//) to determine if the value is already absolute. It then calls urllib.parse.urljoin(), which strips leading C0 control characters and spaces before normalizing. Because the initial check occurs before the stripping step, an attacker may prepend a space or other control character to a protocol‑relative or absolute URL. The leading characters bypass the scheme and startswith('//') tests, allowing the URL to be treated as absolute and redirected to a host outside the application. This flaw is classified as an Open Redirect (CWE‑601).

Pylons WebOb library version 1.8.10 and earlier, used in any Python web application that relies on WebOb for request/response handling. The issue was fixed as of WebOb 1.8.11.

The flaw yields a Medium‑risk open redirect. It can be triggered via any request that assembles a Location header with a space‑prefixed protocol‑relative or absolute URL, bypassing checks in WebOb. Attackers cannot gain code execution or server access; the impact is limited to leading the victim to an external site. Because the attacker must persuade the user to navigate to the redirect, the exploitation requires user interaction. The absence of an EPSS score suggests low availability of public exploits, and the lack of KEV status indicates it has not yet been exploited in the wild. Nonetheless, the moderate CVSS score warrants timely remediation.