The vulnerability is an open redirect in the "/api/google/authorize" endpoint of hunvreus DevPush v0.3.2. An attacker can craft a URL that causes the endpoint to redirect a user to an arbitrary domain, facilitating phishing, malware delivery or other attacks. This weakness is classified as CWE‑601 and exposes users to malicious redirection but does not directly leak data or execute code.

Affected systems are installations of hunvreus DevPush running version 0.3.2. The issue arises when the endpoint processes the redirect parameter without validating the target domain.

The CVSS score of 4.3 indicates a moderate risk. The EPSS score is < 1%, and the vulnerability is not listed in the CISA KEV catalog, suggesting that current exploitation activity may be limited. Because the redirection can be triggered by a visible URL, the likely attack vector is an attacker supplying a crafted link to users, needing user interaction to exploit. The risk to confidentiality or integrity is low; the primary impact is user redirection to malicious sites.