CVE-2026-109937: Otter Blocks 0 to before 3.2.3

Affected technology

Otter Blocks · 0 to before 3.2.3
Vendor not specified by the source

Description’s affected range: before 3.2.3 does not validate that a user-supplied return URL belongs to the site before using it to build the return destination of a Stripe Checkout session

Component: Not specified by the source

What an attacker can do

Unauthenticated attackers can redirect victims who complete or cancel checkout to an arbitrary external URL.