The vulnerability allows an attacker to manipulate the callbackUrl parameter in the SSO API Login endpoint, causing the application to redirect to a user‑specified URL. Because the redirect is not validated, a remote actor can force a browser to navigate to a malicious site. This open redirect can be leveraged for phishing, drive‑by downloads, or session‑hijacking attacks, especially when the target user trusts the legitimate domain.

Kalcaddle Kodbox version 1.67 Build 02 is affected. The flaw resides in the /user/sso/apiLogin path of the SSO API Login component. No other versions or components were mentioned in the advisory, so any deployment of this exact build should be considered vulnerable.

The CVSS score of 5.3 indicates medium severity. The absence of an EPSS score means the exploitation probability is undefined, and the vulnerability is not listed in the CISA KEV catalog. Remote exploitation is plausible, as the exploit does not require local privileges or authentication. The CWE‑601 classification confirms that insufficient input validation on redirect parameters underlies the issue.