The vulnerability allows an attacker to supply an arbitrary redirect URL through the redirectUri parameter during the login flow. The value is reflected directly into a JavaScript document.location assignment without proper encoding, so after the login popup completes, the victim is automatically sent to the attacker‑controlled site. This can be used to facilitate phishing or social engineering attacks, leveraging the user’s trust that they are on the legitimate platform. The weakness is a classic unvalidated redirect, classified as CWE‑601.

WWBN AVideo versions earlier than 26.0 are affected. The open source video platform is deployed by its users and administrators; any instance running a version prior to the fixed release inherits this flaw.

The CVSS score of 2.1 indicates low severity; the EPSS score of less than 1% suggests exploitation is currently unlikely. The flaw is not listed in CISA’s KEV catalog. Exploitation requires a user to click the modified login link and complete the login popup, after which the victim is redirected. Because the attacker does not gain code execution or privileges, impact is limited to facilitating phishing or other social‑engineering attacks. Nonetheless, the risk of credential theft or malware infection remains if users are tricked into visiting malicious sites.