AdonisJS HTTP Server accepts route parameter values and inserts them into URLs via a shared createURL() helper without applying encodeURIComponent. If a parameter begins with a slash, the resulting URL becomes scheme‑relative and can point to an external site. This flaw lets an attacker craft a URL that, when used by the framework’s redirect functions, causes a user’s browser to navigate away from the trusted application, enabling phishing or redirecting OAuth flows to malicious domains. The weakness is categorized as CWE‑601, i.e., Open Redirect.

The vulnerability affects the AdonisJS HTTP Server package used in AdonisJS applications. Versions prior to 8.2.3 and prior to 9.3.0 are impacted. The package is identified by the CNA vendor name adonisjs and the product http‑server.

The CVSS score is 6.1, indicating a high impact potential when exploited. EPSS data is not available, so the current exploitation probability is unknown, and the vulnerability is not listed in the CISA KEV catalog. Because the flaw relies on developer‑controlled route parameters, it can be triggered whenever an attacker-controlled value is inserted into a dynamic first path segment that is subsequently used as a redirect destination. The lack of URL encoding provides a straightforward attack path that is easy to exploit without additional privileges.