The vulnerability is a server‑side open redirect in Angular SSR. When Angular ServerPlatformLocation checks protocol‑relative URLs before WHATWG URL normalization, a crafted request that contains a popping dot segment followed by multiple slashes can bypass the initial check. The resulting normalized pathname begins with two slashes, and Angular SSR places that incorrect pathname in an HTTP Location header. The attacker can thus redirect a browser to an attacker‑controlled origin, enabling phishing, credential theft, or malicious content delivery. The flaw is categorized as CWE‑601, an insecure redirect, and can compromise the confidentiality and integrity of user session data.

Angular applications that use the @angular/platform-server or @angular/ssr packages and were built with a version of Angular earlier than 20.3.33, 21.2.25, or 22.2.1 are affected. If the application exposes route parameters or child routes that accept user‑controlled navigation targets and does not sanitize dot segments or semicolons, the vulnerability can be triggered. Pure client‑side SPAs that do not perform SSR are not impacted.

The CVSS score of 5.1 classifies the vulnerability as medium severity. The EPSS score is not available, and the flaw is not listed in CISA's KEV catalog, suggesting a lower current exploitation probability. Attackers would need to craft a request that reaches the SSR route handling, which is normally exposed to the public, making the attack path available from anywhere. A successful redirect could be used for phishing or cross‑site scripting, but there is no evidence of active exploitation or privilege escalation. The risk is moderate but remediation is recommended to eliminate the redirect vector.