What is CVE-2026-49996?

CVE-2026-49996 is a low-severity vulnerability in Freedomofpress Securedrop-Client, classified under URL Redirection to Untrusted Site (Open Redirect). CVSS score: 3.7/10. Published 2026-08-20.

How severe is CVE-2026-49996?

Low severity. CVSS v3 base score is 3.7 out of 10.

Open Redirect in Freedomofpress Securedrop-Client

CVE-2026-49996

SecureDrop Client is a desktop app for journalists to securely communicate with sources and handle submissions on the SecureDrop Workstation. Prior to version 1.3.1, a malicious SecureDrop Server could bypass securedrop-proxy's origin limitation by responding with cross-origin redirects. SecureDrop Server itself has multiple layers of built-in hardening, and is a dedicated physical machine exposed on the internet only via Tor hidden services for the Source and Journalist interfaces, and optionally via remote SSH access over another Tor hidden service. A newsroom's SecureDrop Workstation communicates only with its own dedicated SecureDrop Server. Version 1.3.1 fixes the issue.

Vulnerability class: Open Redirect

CVSS v3 metric

CVSS v3 base score 3.7 (Low). Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N.

Affected products

Freedomofpress Securedrop-client — versions < 1.3.1

Weakness classification (CWE)

CWE-601 — URL Redirection to Untrusted Site (Open Redirect)

References

security-advisories@github.com (x_refsource_MISC)
security-advisories@github.com (x_refsource_CONFIRM)

Frequently asked questions

What is CVE-2026-49996?: CVE-2026-49996 is a low-severity vulnerability in Freedomofpress Securedrop-Client, classified under URL Redirection to Untrusted Site (Open Redirect). CVSS score: 3.7/10. Published 2026-08-20.
How severe is CVE-2026-49996?: Low severity. CVSS v3 base score is 3.7 out of 10.