CVE-2026-49820
MEDIUMCVE-2026-49820 is a medium-severity (CVSS 4.7) Open Redirect vulnerability in go.probo.inc/probo. O3 Security confirms whether CVE-2026-49820 is actually reachable in your code before you act, and blocks exploitation at runtime until you patch.
Probo has an open redirect bypass via path normalization
Real-World Exposure
go.probo.inc/proboReal-time download stats are indexed for npm and PyPI packages. This vulnerability affects Go packages — download data is not available via public APIs for these ecosystems.
Description
Impact
Probo's saferedirect package validates redirect URLs used across authentication flows (OIDC, SAML, session transfer, OAuth connectors, and trust-center magic links). The validator only inspected the second character of relative paths, so a URL like /../\evil.com passed validation because the second character is .. Go's http.Redirect normalizes this path to /\evil.com before setting the Location header. Browsers can interpret the backslash as a host separator and redirect the user to an external domain (https://evil.com), bypassing the intended same-origin restriction. This enables open-redirect phishing: an attacker can craft a continue parameter (or embed a malicious URL in a session-transfer token) that appears to originate from a trusted Probo domain but redirects victims elsewhere.
Patches
Fixed in go.probo.inc/probo by normalizing relative paths with path.Clean before validation, rejecting backslashes (including
percent-encoded %5c) anywhere in the path, and re-checking the normalized result for protocol-relative and backslash prefixes.
Self-hosted deployments should upgrade to probod v0.194.1 or later.
SaaS deployments on getprobo.com are patched.
Workarounds
No practical workaround for self-hosted installations. Upgrade to the patched release.
Affected Packages
| Ecosystem | Package | Vulnerable range | Fix |
|---|---|---|---|
| 🐹Go | go.probo.inc/probo | all versions | 0.204.0 |
Detection & mitigation playbook
Open-source dependencyDetect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for go.probo.inc/probo. O3's reachability analysis confirms whether the vulnerable code path is actually invoked in your application, so you act on real exposure instead of every transitive match.
Fix
Update go.probo.inc/probo to 0.204.0 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms CVE-2026-49820 is resolved across your whole dependency graph.
Workarounds
If you can't upgrade right away: gate or disable the affected feature, validate untrusted input at the boundary, and avoid passing attacker-controlled data into the vulnerable path. O3's runtime protection blocks exploitation in production as an interim safeguard until the upgrade lands.
How O3 protects you
O3 pinpoints whether CVE-2026-49820 is reachable in your code and exactly where to fix it, then blocks exploitation in production at runtime until the patched version is deployed.
Tailored to CVE-2026-49820. Runtime protection reduces exposure until a permanent patch is applied and verified — it complements patching, it doesn't replace it.
Frequently Asked Questions
Is CVE-2026-49820 in your dependencies?
O3 detects CVE-2026-49820 across Go dependencies and uses function-level reachability to confirm whether the vulnerable code path is actually reachable — not just present. No false positives.