draw.io accepts a ?gitlab= URL parameter that can override the GitLab server URL used during OAuth sign-in. An attacker can embed a crafted link so that a user’s click on the "Authorize in GitLab" dialog opens a popup on the attacker‑controlled host instead of gitlab.com. This redirect allows the attacker to perform credential phishing and to exfiltrate the OAuth session state token. The weakness is a misuse of the GitLab URL parameter (CWE‑601) coupled with the disclosure of sensitive information (CWE‑200).

jgraph draw.io versions prior to 29.7.9 are affected. Version 29.7.9 and later include a fix that prevents the parameter from redirecting to an arbitrary host.

The CVSS score of 3.4 indicates low severity. No EPSS score is available and the vulnerability is not listed in CISA KEV. The attack requires a user to click a crafted link and then authorize in GitLab, so the attack vector is web-based user interaction. Success does not grant arbitrary code execution or system compromise; it primarily enables phishing of credentials and session tokens.