CVE-2026-33397 describes an Open Redirect vulnerability in Angular SSR versions prior to 22.0.0-next.2, 21.2.3, and 20.3.21, resulting from an incomplete fix for a prior issue. Attackers can bypass validation by injecting a single backslash into the X-Forwarded-Prefix header, causing modern browsers to redirect users to an attacker-controlled domain, potentially enabling phishing or credential theft. This vulnerability is rated Medium severity (CVSS 6.9) and is a network-based attack requiring no user interaction, also allowing for web cache poisoning. There is currently no evidence of active exploitation, public exploit code, or significant community discussion regarding this flaw. Organizations should apply the provided patches or sanitize the X-Forwarded-Prefix header as a mitigation.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
>= 20.0.0, < 20.3.21CPE matchmatch criteria | cpe:2.3:a:angular:angular_cli:*:-:*:*:*:node.js:*:* | ||
>= 21.0.0, < 21.2.3CPE matchmatch criteria | cpe:2.3:a:angular:angular_cli:*:-:*:*:*:node.js:*:* | ||
22.0.0CPE matchmatch criteria | cpe:2.3:a:angular:angular_cli:22.0.0:next0:*:*:*:node.js:*:* | ||
22.0.0CPE matchmatch criteria | cpe:2.3:a:angular:angular_cli:22.0.0:next1:*:*:*:node.js:*:* |
CVSS version used by this source: 4.0
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.1 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.