The vulnerability is an open redirect that occurs in Mailerup’s click‑tracking endpoint. An attacker can supply a crafted query parameter that bypasses scheme validation by using an allowed scheme (http, https) while the host is unrestricted. Because the framework silently catches a BadSignature exception, a valid signed token is not required, making the redirect easier to use. As a result, victims who click a seemingly legitimate link can be sent to any external site, creating a serious risk for phishing or credential theft.

Any Mailerup installation running a version earlier than 1.0.0 on any platform is impacted. The issue exists across all operating systems supported by the product as the redirect logic is not platform‑specific.

The CVSS base score is 5.3, indicating moderate severity. EPSS data is not provided, but the vulnerability is not listed in the CISA KEV catalog, suggesting no widespread exploitation yet known. Despite this, the flaw allows unauthenticated attackers to construct and share malicious URLs, so the likelihood of attack by targeted phishing campaigns remains significant. The lack of signature validation further lowers the barrier for exploitation.