The vulnerability arises from improper handling of scheme-relative URLs, where paths beginning with double slashes are treated as internal redirects. An attacker can craft a URL on a trusted Masa CMS domain that forwards a victim to an external, attacker-controlled site. This can be used for phishing campaigns and, in some authentication flows, may inadvertently expose tokens or other sensitive data to the malicious destination. The weakness is classified as CWE‑601.

Affected products are MasaCMS MasaCMS. Versions prior to 7.2.10, 7.3.15, 7.4.10, or 7.5.3 are vulnerable; later releases include the fix.

The CVSS score of 5.3 indicates a moderate severity. EPSS is not available, and the issue is not listed in the CISA KEV catalog. The likely attack vector is a crafted link sent to users on the trusted domain; no special privileges are required, making exploitation plausible in phishing scenarios.