SvelteKit before 3.0.0 Open Redirect via Enhanced Form Actions

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2026-114060 · Microsoft / collected KEV context

GHSA-pfhg-q3qv-9q6r

cve-program · CVE-2026-114060

• https://github.com/sveltejs/kit/security/advisories/GHSA-pfhg-q3qv-9q6r
• https://www.vulncheck.com/advisories/sveltekit-before-3.0.0-open-redirect-via-enhanced-form-actions

nvd · CVE-2026-114060

• https://github.com/sveltejs/kit/security/advisories/GHSA-pfhg-q3qv-9q6r
• https://www.vulncheck.com/advisories/sveltekit-before-3.0.0-open-redirect-via-enhanced-form-actions

osv · GHSA-pfhg-q3qv-9q6r

• https://github.com/sveltejs/kit/security/advisories/GHSA-pfhg-q3qv-9q6r
• https://nvd.nist.gov/vuln/detail/CVE-2026-114060
• https://github.com/sveltejs/kit/commit/91aae3547c6cd2935d79c09a53e27c740100000a
• https://github.com/sveltejs/kit
• https://github.com/sveltejs/kit/releases/tag/@sveltejs/[email protected]
• https://www.vulncheck.com/advisories/sveltekit-before-3.0.0-open-redirect-via-enhanced-form-actions

No related operational record is retained in the current change model.