An open redirect flaw exists in Angular SSR’s URL processing logic. The code removes only a single leading slash from URL segments, allowing an attacker to send a value that starts with three slashes via the X‑Forwarded‑Prefix header when the application runs behind a proxy. The result is that internal routing can redirect users to arbitrary sites, facilitating large‑scale phishing or search‑engine hijacking. This is a classic CWE‑601 vulnerability with a CVSS score of 6.9, indicating a moderate severity.

The weakness affects Angular CLI projects on the 19.x branch before version 19.2.21, the 20.x branch before version 20.3.17, and the 21.x branch before 21.1.5 and 21.2.0‑rc.1. Any deployment that processes the X‑Forwarded‑Prefix header without sanitization and whose cache does not vary on that header is vulnerable.

The exploitation probability is very low, with the risk metric indicating less than a 1% likelihood of exploitation. The vulnerability is not identified in CISA’s catalog of known exploited vulnerabilities. The most likely attack vector is remote, with an adversary able to influence the X‑Forwarded‑Prefix header through a compromised or malicious reverse proxy or CDN. While the chance of exploitation remains modest, the potential impact on user safety and brand reputation remains significant.