Back to security portal
Open Redirect on trezor.io via /admin Cloudflare Rewrite
Reported on May 29, 2026
A redirect rule on trezor.io accepted unvalidated input into its destination, so a link that appeared to point at our domain could send visitors elsewhere. The rule now uses a fixed destination.
Reported by Refangga
Resolved vulnerabilities
Reported by community. Investigated. Resolved. Because your security is never optional.
- THP pairing could be completed without the pairing codeJune 22, 2026
- Desktop update could install before signature verification completedJune 16, 2026
- Solana account-creation confirmation completenessJune 14, 2026
- Solana signing display improvementJune 12, 2026
- Coordination fee cap shown on CoinJoin authorizationJune 3, 2026
- Solana token-transfer recipient spoofing via Address Lookup Table referenceJune 1, 2026