The flaw in busy’s callback handler lets an attacker supply a manipulated state argument that causes the application to redirect to any URL specified by the attacker. This unvalidated redirect flaw is a classic example of CWE‑601, making it possible to lure users to malicious sites, which can enable phishing or drive–by‑download attacks. The impact is primarily on user trust and possible compromise of subsequent sessions, rather than direct compromise of the server itself.

The vulnerability exists in the busy application hosted on the busyorg GitHub repository, affecting all releases up to and including version 2.5.5. The offending code resides in the file source-code/busy-master/src/server/app.js within the callback handler component. No other vendors or product variants are listed as affected by the CNA data.

The CVSS base score of 5.1 indicates moderate severity. The EPSS score of less than 1 % suggests a very low probability that the vulnerability has been exploited yet, and it is not listed in the CISA KEV catalog. Nonetheless, because the attack can be launched remotely by simply visiting a crafted URL, the risk to end users remains real and can be magnified if the application is used as part of a user‑facing service. Monitoring for suspicious redirects and limiting redirect targets are recommended to mitigate the potential for phishing or credential‑stealing attacks.