ArcGIS Server includes an input validation weakness in the login redirection workflow. An authenticated attacker can exploit this by sending a specially crafted request that causes the application to redirect the browser to an unintended, untrusted site. The vulnerability results in a limited confidentiality impact if the user interacts with the redirected page. This flaw does not permit server‑side compromise or broader cross‑component damage.

Esri ArcGIS Server 11.5 is the only version known to be affected by this vulnerability. No other software or version ranges are listed as impacted.

The CVSS score of 4.7 places this issue in the moderate range, and the EPSS score is not available which indicates insufficient data on current exploitation activity. The vulnerability requires the attacker to be authenticated and relies on client‑side navigation logic, limiting the attack surface. It is not listed in CISA’s KEV catalog, underscoring that while the flaw can lead to phishing‑style redirection, it is unlikely to be frequently exploited in the wild.