Chamilo LMS allows anyone with access to the login page to supply an arbitrary redirect URL via the redirect parameter without server-side validation. This leads to an open redirect that can send unsuspecting users to malicious sites. The vulnerability is identified as a CWE-601 open redirect, enabling potential phishing, click-jacking, or social-engineering attacks.

The issue affects the Chamilo Learning Management System from its 1.11.0 release through 2.0-beta.1. Users operating those versions are at risk. The product is developed by the Chamilo community.

No CVSS score is published, and the EPSS score is unavailable. The vulnerability is not listed in CISA KEV. The attack vector is remote, accessible via the web interface using the login redirect parameter. Because no authentication is required, the potential impact depends on the attacker’s ability to entice users into following the link; it can facilitate phishing or malicious site redirection, but does not expose sensitive data directly. The overall risk is moderate, but any compromised users could be manipulated.