The vulnerability stems from an unknown function in the admin/ component of the Student‑Management‑System. By manipulating the uid argument, an attacker can trigger an unintended redirect after authentication, creating an open‑redirect scenario that may be leveraged for phishing or credential‑stealing attacks. This issue is related to CWE‑698 (Untrusted Redirect) and CWE‑705 (Link Location Manipulation). The attackers do not gain direct code execution on the server; the impact is limited to the redirection of authenticated users to arbitrary URLs.

The software is known as Student‑Management‑System by a4m4, with affected code up to commit f0c5f6842c5e8c431ff02b5260a565ca844df3a0. Because the project follows a rolling‑release model, no discrete version numbers are available, and the fix may have been published in the latest commit. Several endpoints in the admin/ namespace are affected, so any instance using the unpatched code is vulnerable.

The CVSS score of 5.3 denotes a medium severity, but the EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is a crafted HTTP request to the vulnerable admin endpoint, which is accessible remotely and requires only network access to the host. Attackers can supply a malicious uid value that causes the application to redirect points of entry users to arbitrary sites, raising the risk profile for exposed deployments. The overall risk is moderate but can become high if the admin interface is reachable from untrusted networks.