The flaw is located in HoloViz Panel versions 1.2.2 through 1.8.x, where the authentication handlers store an unvalidated next query parameter in a cookie. After a successful login, users are redirected to the URL supplied in this parameter, enabling attackers to send victims to arbitrary external sites. This open redirect can be leveraged for phishing or malware delivery, and it is categorized as CWE‑601.

All installations of HoloViz Panel from version 1.2.2 up to, but not including, 1.9.0 are vulnerable. The issue is present in the default BasicLoginHandler and PasswordLoginHandler defined in panel/auth.py. Versions 1.9.0 and later are not affected.

The CVSS score of 5.1 indicates a moderate severity, while the EPSS score is not available, leaving the exploitation probability uncertain. The vulnerability is not listed in the CISA KEV catalog, suggesting limited known exploitation. An attacker can trigger the redirect by directing a victim to a login link containing a crafted next parameter, which requires only a web request to the target system.