The open redirect flaw in Thelia version 2.6.0 allows an attacker to supply any URL through the `next` query parameter during the address creation process. When the user submits the form, the application redirects to the supplied URL without validating the destination’s origin or membership in an allowlist. This vulnerability enables attackers to send legitimate users to malicious sites, facilitating phishing or malware delivery to potentially compromise the user’s session or trust in the site.

Thelia e‑commerce platform, version 2.6.0, is the only release known to contain this flaw. No other Thelia versions are reported to be affected. The issue resides in the address‑creation workflow and is limited to this specific version.

The CVSS score of 6.1 classifies the vulnerability as Medium severity. The EPSS score is reported as < 1%, indicating a low likelihood of current exploitation. The flaw is not listed in CISA’s KEV catalog. Exploitation requires only a crafted URL, with no authentication explicitly mentioned; the lack of an authentication requirement is inferred from the description. An attacker can lure users via phishing to trigger the redirect. Because the application does not perform origin validation on the `next` parameter, a malicious destination can lead users to phishing sites, weaken the site’s reputation, or serve malware. The simplest attack path is a single‑click link, making it a social‑engineering vector of moderate risk.