AdonisJS HTTP Server versions before 7.8.1 and 8.0.0‑next.0 through 8.1.3, as well as earlier @adonisjs/core releases, accept a Referer header from an incoming HTTP request and redirect the browser to that URL without verifying the target host. This flaw, identified as a CWE‑601 Open Redirect vulnerability, allows an attacker who can set or influence the Referer header to redirect honest users of the application to a malicious site, potentially facilitating phishing or other social‑engineering attacks.

Any project that uses @adonisjs/http-server through the response.redirect().back() or response.redirect('back') API and runs a vulnerable version is impacted. The vulnerability is present in @adonisjs/http-server prior to 7.8.1 and before 8.2.0, and in @adonisjs/core prior to 7.4.0.

The CVSS base score is 6.1, indicating a moderate severity. No EPSS value is available, and the issue is not listed in CISA's KEV catalog. The likely attack vector is a remote injection via crafted HTTP requests that supply a malicious Referer header. Attacker control of the Referer header allows malicious redirection of users without requiring authentication or exploit of additional services.