The vulnerability is an unvalidated redirect in the social login flow of Venueless that allows an attacker to embed arbitrary URLs. By leveraging this redirect, attackers can craft phishing URLs that appear to come from trusted domains, thereby deceiving users into giving away credentials or other sensitive information. Internally it is a form of open redirect (CWE‑601) and does not grant direct code execution but poses a significant risk of credential compromise.

The affected system is Venueless, a product from pretix, implemented via its social login functionality. No specific version information is provided in the advisory, so all installations that rely on this social login path are potentially vulnerable until a patch is applied.

The CVSS score of 5.1 indicates a moderate severity level. The EPSS score is not available, and the vulnerability is not currently listed in the CISA KEV catalog. The likely attack vector is the social login redirect parameter, which can be manipulated by an adversary to redirect authenticated users to malicious sites. Exploitation requires no special privileges beyond the ability to access the social login URL and can lead to phishing attacks that compromise user credentials or other confidential data.