{"id":"GHSA-4r8q-gv9j-3xx6","aliases":["CVE-2021-32645"],"title":"Open Redirect","description":"### Impact\nIn some situations, it is possible to have open redirects where users can be redirected from your site to any other site using a specially crafted URL.\nThis is only the case for installations where the default Hostname Identification is used and the environment uses tenants that have `force_https` set to `true` (default: `false`)\n\n### Patches\nVersion 5.7.2 contains the relevant patches to fix this bug. Stripping the URL from special characters to prevent specially crafted URL's from being redirected to.\n\n### Workarounds\nThere is a simple way to work around the security issue\n- Set the `force_https` to every tenant to `false`\n\n### References\nhttps://nvd.nist.gov/vuln/detail/CVE-2018-11784\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Contact us in Discord: https://tenancy.dev/chat\n","severity":"medium","score":4.3,"published":"2022-03-18T17:55:07.000Z","modified":"2026-07-08T06:27:23.805Z","withdrawn":false,"knownExploited":false,"affected":[{"ecosystem":"Packagist","name":"hyn/multi-tenant","ranges":[{"events":[{"introduced":"5.6.0"},{"fixed":"5.7.2"}],"type":"ECOSYSTEM"}],"versions":["5.6.0","5.6.1","5.6.2","5.6.3","5.6.4","5.7.0","5.7.1"],"fixed":["5.7.2"]}],"references":["https://github.com/tenancy/multi-tenant/security/advisories/GHSA-4r8q-gv9j-3xx6","https://nvd.nist.gov/vuln/detail/CVE-2021-32645","https://github.com/tenancy/multi-tenant/commit/9c837a21bccce9bcaeb90033ef200d84f0d9e164","https://packagist.org/packages/hyn/multi-tenant","https://webmasters.googleblog.com/2009/01/open-redirect-urls-is-your-site-being.html"],"sources":[{"name":"OSV","id":"GHSA-4r8q-gv9j-3xx6","modified":"2026-07-08T06:27:23.805983715Z","url":"https://osv.dev/vulnerability/GHSA-4r8q-gv9j-3xx6"}],"assessments":[{"source":"OSV","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","score":4.3}]}