This flaw resides in the graphical interface of the HPE Aruba Private 5G Core on‑prem product. An attacker can craft a URL that hijacks the login flow and forces an authenticated user to be redirected to a malicious, attacker‑controlled address that serves a counterfeit login page. The victim may then unknowingly enter their credentials, which the attacker captures before returning them to the legitimate site. This results in potential compromise of user accounts and downstream services.

The vulnerability affects the HPE Aruba Networking Private 5G Core on‑prem GUI in all deployed versions of the product. Specific version information is not provided, so all installations should be treated as potentially vulnerable until a patch is applied.

The CVSS score of 8.8 indicates a high-impact flaw. An attacker only needs to supply a crafted link—such as via phishing email or embedded in a malicious site—to trigger the redirect. The requirement for an authenticated user reduces the immediate exploitation window, yet once a user is lured, credential compromise is likely. EPSS data is unavailable and the issue is not listed in KEV, suggesting no confirmed widespread exploitation yet, but the high severity and credential theft possibility make this a critical concern.