CVE-2026-126947
MEDIUM
NVD
CVSS Score
5.4
Severity
MEDIUM
Published
Nov 13, 2026
Vendor
unknown
Description
Zipline before 4.5.0 contains a stored open redirect vulnerability that allows authenticated users to set arbitrary short URL destinations by abusing missing scheme validation in POST /api/user/urls. Attackers can store javascript: URIs or attacker-controlled URLs as destinations, causing visitors of the trusted short link to be redirected to phishing or malware pages.