web2py up to and including version 2.27.1‑stable+timestamp.2023.11.16.08.03.57 contains an open redirect flaw. A malicious actor can craft a URL that, when visited, causes the browser to be redirected to an arbitrary website. This redirect can be leveraged to deliver phishing pages, social‑engineering attacks, or other malicious content to unsuspecting users. The vulnerability does not directly expose sensitive data or allow code execution, but it does undermine trust and can lead to credential compromise if the phishing site is designed to mimic legitimate services.

The affected application is web2py. Versions up to and including 2.27.1‑stable+timestamp.2023.11.16.08.03.57 contain the flaw; all newer releases released after this timestamp are considered unaffected.

The CVSS score of 5.1 reflects a moderate severity. The EPSS score of less than 1% indicates a low probability that the flaw will be actively exploited in the wild, and it is not listed in the CISA KEV catalog. The attack vector is remote, requiring an attacker to supply a crafted link that a victim clicks or navigates to. Once triggered, the redirect occurs automatically without further interaction, making it relatively easy to deploy in a phishing campaign.