An open‑redirection flaw exists in the login form endpoint of the latest demo version of the Cradle eCommerce platform. The ‘returnUrl’ parameter is accepted without proper validation, allowing an attacker to craft a link that redirects users from a legitimate site to any external URL. This can be used to deceive users into visiting malicious sites that may host phishing or malware. The vulnerability does not produce immediate code execution or data exfiltration, but it undermines user trust and can facilitate credential‑phishing campaigns.

The affected product is Cradle eCommerce by Cradle. The flaw manifests in the demo deployment version’s login form. Only the eCommerce component is impacted; the associated CMS is not affected because it lacks user accounts and collections.

The CVSS base score is 5.3, indicating a medium‑severity disclosure. The EPSS score is not provided, and the flaw is not listed in the national KEV catalog. Exploitation requires an attacker to supply a crafted login URL containing the returnUrl parameter, which leads to the redirection. Such an attack path is simple and usually driven by social‑engineering, making the risk moderate but non‑negligible for users who may follow outbound links.