The vulnerability is an open redirect flaw in Discourse’s StaticController. The enter action reads an sso_destination_url cookie and redirects to that URL without validating it. Because the cookie can be set by an attacker, the application can send users to arbitrary external sites, enabling phishing or other social‑engineering attacks. The weakness corresponds to CWE‑601, an unvalidated redirect or forward.

Discourse versions from 2026.1.0 up to but excluding 2026.1.3, from 2026.2.0 up to but excluding 2026.2.2, and from 2026.3.0 versions before 2026.3.0 are affected. The issue is fixed in 2026.1.3, 2026.2.2, and 2026.3.0.

The CVSS score of 5.1 indicates moderate severity, and the EPSS score of less than 1 % suggests the likelihood of exploitation is low. The vulnerability is not listed in the CISA KEV catalog. The attack vector is client‑side: an attacker can set the sso_destination_url cookie with a malicious URL and then direct a user to the vulnerable entry point. Upon visiting the link, the user is redirected to the attacker’s chosen site. Because no server‑side authentication or validation is performed, the redirect is guaranteed if the cookie is present.