An attacker can exploit the application server to trigger redirects to attacker‑controlled URLs. This flaw enables phishing campaigns that trick users into submitting credentials or other sensitive data on malicious sites. The underlying weakness, identified as CWE‑601, allows arbitrary URLs to be injected into the redirection process without requiring any authentication. Consequently, any user who can access the vulnerable web application becomes a potential target.

IBM WebSphere Application Server Liberty versions released as 17.0.0.3 through 26.0.0.10 are vulnerable. Applying Liberty Fix Pack 26.0.0.11 or any later patch removes the flaw.

The CVSS score of 4.3 reflects a moderate impact, yet the nature of the vulnerability—remote URL manipulation—poses a significant phishing risk. No EPSS information is available, and the vulnerability has not been reported in the CISA KEV catalog. The likelihood of exploitation remains unclear, but because no authentication is needed, the attack vector is remote network access and any exposed application could be leveraged for phishing attempts.