The vulnerability arises from inadequate validation of callback URLs in WSO2 Identity Server. Malicious actors can craft URLs that pass through a weak regular expression or bypass validation entirely, causing the server to redirect users to attacker‑controlled sites. This open redirect can be used to mount phishing attacks, deceiving users into entering credentials or sensitive information, potentially leading to data theft or unauthorized access.

WSO2 Identity Server versions 5.10.0 through 5.11.0, 6.0.0 through 6.1.0, and 7.0.0 through 7.1.0 are affected.

The CVSS score of 4.3 indicates moderate severity; the EPSS score is not available, and the vulnerability is not listed in CISA KEV. Attackers can exploit the flaw by distributing a specially crafted link that appears legitimate, and users clicking the link are redirected to malicious sites. The web‑based attack vector is likely, requiring no special privileges or credentials. While the exploitation potential does not involve remote code execution, the phishing impact can lead to significant credential compromise.