The vulnerability is an URL redirection flaw (open redirect) that allows an attacker to direct users to untrusted sites without the user’s consent. An attacker who can influence the redirect URL can impersonate legitimate services, facilitating phishing or credential theft. The flaw directly impacts the confidentiality and integrity of the authentication process by enabling malicious entities to masquerade as trusted AD FS endpoints.

Microsoft products affected include Windows 10 versions 1607 and 1809, Windows Server 2016 (standard and Server Core), Windows Server 2019 (standard and Server Core), Windows Server 2022, and Windows Server 2025 (standard and Server Core). No further version granularity is provided.

The CVSS score of 6.5 indicates moderate severity. The EPSS score is currently unavailable, and the vulnerability is not listed in CISA's KEV catalog, suggesting no widespread active exploitation is confirmed at this time. However, the attack vector (open redirect) can be leveraged by any attacker who can influence AD FS redirect URLs, making it a realistic risk if left unmitigated.