The flaw lies in the /login endpoint of Smart‑SSO versions up to 2.1.1. An unvalidated redirectUri parameter permits an attacker to craft a login URL that redirects an authenticated user to a malicious target. When the user completes the authentication flow, the OAuth2 authorization code is sent to the attacker's redirect URL. The attacker can then exchange that code for an access token at /oauth2/access_token using any valid client identifier, effectively bypassing authentication and obtaining the victim’s token.

Affected systems are installations of Smart‑SSO supplied by vendor a466350665 running version 2.1.1 or earlier. No other product versions are explicitly mentioned as vulnerable in this advisory.

Based on the description, the attacker must be able to supply a crafted login URL and control the redirectUri parameter, but the advisory does not explicitly state that user credentials are required. It is inferred that the attacker does not need to know victim credentials to abuse the redirect, relying instead on the open redirect to capture the authorization code. The CVSS score of 7.6 indicates high severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires only the ability to embed the redirectUri in a crafted link; once the attacker obtains the token, it can be used against any protected resource that relies on the same OAuth2 flow.