IFTOP, a product of WellChoose, contains an open redirect vulnerability that allows authenticated remote attackers to craft a URL which redirects users to arbitrary external sites. This flaw, classified as CWE-601, can be exploited to send users to malicious websites, potentially facilitating phishing or other malicious actions. The impact is the compromise of user trust and the redirection of users to unauthorised content.

Affected products include WellChoose IFTOP and the associated organization portal system. No specific version information is provided; consequently all deployed instances of these products are potentially vulnerable until they are updated to IFTOP_P4_181 or later, as recommended by the vendor.

The CVSS score is 5.1, indicating medium severity. The EPSS score is less than 1%, suggesting a low likelihood of widespread exploitation. The vulnerability is not listed in the CISA KEV catalog. Attacker needs to be authenticated to the application, after which they can craft a redirect URL, representing a remote attack vector.