The vulnerability resides in the is_safe_url function within doorman's users/views.py. By tampering with the Next argument, an attacker can forge a redirect to an arbitrary external site, enabling phishing or malicious content delivery. This flaw allows a remote attacker to control the destination URL issued by the application.

The issue affects the mwielgoszewski doorman application up to version 0.6. Users running any release preceding 0.7 are potentially exposed.

The CVSS score of 5.3 indicates moderate severity, while the EPSS score of less than 1 % reflects a very low probability of exploitation at present. The flaw is not listed in the CISA KEV database, but public exploit code has been shared and the attack can be carried out remotely. The open‑redirect functionality creates an attack surface that could be leveraged for credential phishing or malware delivery, with no authentication or privilege requirement.