The vulnerability in the browser-based Cisco Webex App arises from inadequate validation of URL parameters in HTTP requests. This flaw allows an attacker to embed a specially crafted link that, when followed by a user, causes the application to redirect to an arbitrary external site. The direct consequence is that a user can be sent to a malicious webpage without their intent, exposing them to phishing attacks or credential harvest sites. The weakness is an improper input validation flaw classified as CWE-601.

Cisco Webex App is affected. No specific version information is provided in the advisory, but the issue exists in all browser‑based deployments of the application that have not yet incorporated Cisco’s latest update.

The CVSS score for this vulnerability is 4.3, indicating moderate severity. The EPSS score is below 1%, implying that passive exploitation is unlikely. The vulnerability is not listed in CISA’s KEV catalog. Based on the description, the likely attack vector is remote, unauthenticated, and relies on a user clicking a malicious link. The vulnerability requires no privileged access, and can be exploited by simply sending the crafted URL to a victim.