The vulnerability is an open redirect flaw in the login flow of Redash. After authentication, the application uses a user‑supplied "next" parameter to determine where to send the user. The function host but does not collapse multiple leading slashes, so a crafted value such as "/login?next=////evil.com" passes the checks and redirects the authenticated user to an external domain. This provides an attacker with a path to phish users, deliver malware via the redirected classic URL manipulation error and is classified as CWE‑601.

All installations of Redash from version 5.0.2 up to and including 26.3.0 are affected. The issue is present in the authentication module of applies through a web interface.

The CVSS score of 6.1 indicates a medium severity vulnerability. The EPSS score is below 1%, implying a very low probability of exploitation in the wild at present, and the vulnerability is not listed in CISA’s KEV catalog. An exploit requires a user to authenticate and then click a link or visit a page containing the crafted redirect URL, so social engineering or phishing campaigns would be needed to leverage this flaw. While the risk is moderate, the presence’s post‑login experience for malicious purposes.