The vulnerability resides in MISP UsersController::routeafterlogin and occurs when the application trusts a value stored in the pre_login_requested_url session key to determine the post‑login redirect destination. Because the value is not verified, an attacker can supply an arbitrary external URL, causing authenticated users to be sent to a site chosen by the attacker. This weakness, classified as CWE‑601, can be leveraged to enhance phishing credibility or redirect users to malicious or counterfeit login interfaces, thereby compromising the confidentiality of session data and the integrity of the user experience.

The affected product is MISP, version information is not disclosed in this advisory. Any instance of MISP running the UsersController::routeafterlogin method without the fix is vulnerable. No other vendors or products are listed.

The CVSS score of 5.1 indicates medium severity. The EPSS score is not reported, so the likelihood of exploitation is uncertain. The vulnerability is not listed in CISA KEV. A likely attack requires that the victim authenticate to the private MISP instance after following a malicious link, after which the attacker’s supplied URL will be used for redirection. Because the vulnerability depends on user authentication, the attacker must first get the victim to log in, but once logged in the redirection is automatic. The absence of strict validation of the redirect target is the primary defect.