A flaw in the OAuth2Client component of the hsweb-framework allows a remote attacker to supply a malicious redirect URI, causing the application to forward users to arbitrary external sites. This open redirect vulnerability can be exploited for phishing attacks, credential harvesting, or malicious content delivery, potentially compromising user trust and confidentiality. The impact is limited to redirect flows but can be leveraged as a vector for broader social engineering attacks.

The vulnerability affects hsweb-framework versions up to and including 5.0.1. Users running any of these releases should verify the installed version and determine whether an upgrade to the patched release is available.

The CVSS score of 5.3 classifies the issue as moderate severity. EPSS data is not available, and the vulnerability is not yet listed in the CISA KEV catalog. The attack can be performed remotely by crafting a malicious redirect parameter in the OAuth2 flow; public exploitation code has been identified, making the threat real and actionable. The risk is therefore moderate but present, especially in environments where the application trusts users' redirect URLs without strict validation.