The vulnerability is an unvalidated redirect in NocoDB’s login flow caused by the lack of verification for the continueAfterSignIn parameter. During authentication, the application accepts a user‑controlled value and performs client‑side navigation without checking the destination’s origin, domain or protocol. Although it does not allow code execution or privilege escalation, it enables attackers to redirect legitimate users to malicious sites after login, facilitating phishing attacks and increasing the risk of credential theft.

Affected systems include the NocoDB application for all versions earlier than 0.301.0. The vulnerability is present in any deployment of NocoDB that includes the unpatched login flow, regardless of the hosting environment.

The CVSS score of 5.7 rates this issue as moderate, and the EPSS score of less than 1% suggests a low likelihood of exploitation. However, once a user authenticates, a malicious attacker can direct them to arbitrary URLs which could cause phishing success. Because the attack vector requires only the ability to supply a URL to the continueAfterSignIn parameter, it can be leveraged by anyone with access to a login link or through social engineering. The CVE is not listed in the CISA KEV catalog at this time.