Description

Probo is a self-hostable governance, risk, and compliance (GRC) platform built for engineering and security teams. Probo's `saferedirect` package validates redirect URLs used across authentication flows (OIDC, SAML, session transfer, OAuth connectors, and trust-center magic links). Prior to version 0.19.3.1, the validator only inspected the second character of relative paths, so a URL like `/../\evil.com` passed validation because the second character is `.`. Go's `http.Redirect` normalizes this path to `/\evil.com` before setting the `Location` header. Browsers can interpret the backslash as a host separator and redirect the user to an external domain (`https://evil.com`), bypassing the intended same-origin restriction. This enables open-redirect phishing: an attacker can craft a `continue` parameter (or embed a malicious URL in a session-transfer token) that appears to originate from a trusted Probo domain but redirects victims elsewhere. This is fixed in `go.probo.inc/probo` 0.193.1 by normalizing relative paths with `path.Clean` before validation, rejecting backslashes (including percent-encoded `%5c`) anywhere in the path, and re-checking the normalized result for protocol-relative and backslash prefixes. Self-hosted deployments should upgrade to probod v0.194.1 or later. SaaS deployments on getprobo.com are patched. No practical workaround is available for self-hosted installations.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.7",
  "pubDate": "2026-08-13T15:19:41.410Z",
  "pubdate": "2026-08-13T15:19:41.410Z",
  "executiveSummary": "An open-redirect vulnerability exists in the saferedirect package of the Probo governance, risk, and compliance (GRC) platform prior to version 0.19.3.1. The flaw allows malicious actors to construct crafted URLs containing specifically formatted relative paths that bypass the platform's redirect validation logic. When processed by Go's http.Redirect function and interpreted by modern web browsers, these inputs result in unauthorized external redirection to arbitrary domains.\nThe vulnerability impacts self-hostable Probo deployments utilizing vulnerable versions of the go.probo.inc/probo codebase across authentication flows including OIDC, SAML, session transfer, OAuth connectors, and trust-center magic links. Attackers can leverage this capability to execute sophisticated open-redirect phishing campaigns, deploying deceptive URLs that appear to originate from a trusted Probo domain while ultimately redirecting unsuspecting victims to attacker-controlled external infrastructure. This undermines the integrity of session management and authentication handoffs, posing significant social engineering risks to organizations relying on self-hosted instances.\nExploitation requires no prior authentication or elevated privileges, as it can be triggered externally via crafted parameters such as a continue parameter or embedded malicious URLs within session-transfer tokens. Because no practical local workarounds exist for self-hosted installations, remediation requires an immediate upgrade to the patched software versions.",
  "technicalDetails": "The vulnerability resides within the saferedirect package of the go.probo.inc/probo platform, specifically in the input validation mechanisms responsible for parsing and verifying redirect URLs used across critical authentication flows like OIDC, SAML, session transfers, OAuth connectors, and trust-center magic links. Prior to version 0.19.3.1, the vulnerable validator implemented an insufficiently rigorous inspection algorithm that exclusively evaluated the second character of relative paths.\nDue to this restricted validation scope, malformed relative paths such as /../\\evil.com successfully bypassed security checks because the second character evaluated to a period (.). Subsequently, when the application executed Go's http.Redirect function, the underlying path was normalized to /\\evil.com prior to setting the HTTP Location header. Upon receiving this header, browsers improperly interpreted the backslash character as a host separator, initiating an external redirection to the malicious domain (https://evil.com) and successfully circumventing intended same-origin restrictions.\nThe attack flow proceeds as follows: An attacker crafts a malicious link targeting a self-hosted Probo instance, embedding the payload within authentication continuation parameters or session-transfer tokens. A victim interacts with the URL, believing it to be a trusted resource on the target GRC platform. The Probo server validates the parameter using the flawed saferedirect package, incorrectly flags the input as safe due to the superficial second-character check, and issues an HTTP redirect response containing the unmitigated payload. The victim's browser normalizes and interprets the backslash, routing the user away from the trusted origin to an external site controlled by the attacker.\nThe vulnerable component is the saferedirect package within versions prior to 0.19.3.1 of go.probo.inc/probo. The flaw can be exploited remotely over the network without authentication or privileges, impacting all unpatched self-hosted deployments."
}