Echo is a Go web framework that builds redirect URLs using the scheme value from forwarded headers such as X-Forwarded-Proto, X-Forwarded-Protocol, or X-Url-Scheme. Before version 4.15.2 and 5.1.1, the framework does not validate that these headers contain supported web schemes. Consequently, an attacker who can control these headers can force the redirection middleware to generate a Location header with any URI scheme, including non‑HTTP schemes such as mailto: or other custom protocols. An unsuspecting user following the redirect would then be directed to a malicious endpoint, creating an open redirect vector that can be exploited for phishing or other social‑engineering attacks. This vulnerability is a classic CWE‑601 open redirect flaw.

The flaw exists in Echo releases earlier than 4.15.2 and 5.1.1, affecting all deployments that use the WWWRedirect or NonWWWRedirect middlewares and rely on forwarded scheme headers. The issue is fixed in the cited release tags, so any component that has not been updated to at least those versions is vulnerable. Systems that do not employ these middlewares or that use the HTTPS‑specific redirect variants are not impacted.

The CVSS score of 4.7 indicates a moderate severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is remote header injection through HTTP proxies or load balancers that set forwarded scheme headers. Exploitation requires an affected redirect middleware and user interaction with the malicious redirect response. Because the attack relies on user click‑through, the impact is primarily a social‑engineering risk rather than a direct compromise of the server itself.