The vulnerability allows an attacker to manipulate the Referer header to force the sign‑in module of the Diem project to redirect users to an arbitrary URL. This results in an open redirect flaw that can be used for phishing or social engineering attacks, potentially leading users to malicious sites without their knowledge. The flaw does not grant direct code execution, system compromise, or data exfiltration, but it facilitates credential harvesting and other downstream attacks.

This issue affects the Diem project’s sign‑in component, specifically the file dmCorePlugin/plugins/dmUserPlugin/modules/dmUser/lib/BasedmUserActions.class.php. Because the project follows a rolling release strategy, a specific fixed version is not identified; therefore any release up to the commit 116974edfb9a5b8bd69cb13586dc62bcdbb485ad is susceptible. Users should verify that their deployment is not based on an older codebase.

The CVSS score of 5.3 indicates moderate severity. The exploit is publicly disclosed and can be executed remotely via HTTP requests to the sign‑in endpoint. No current EPSS data is available and the vulnerability is not listed in the CISA KEV catalog. Attackers can leverage this by passing crafted Referer values, causing victims to be redirected to attacker‑controlled sites.