Saltcorn is an open source no‑code database builder. In versions prior to 1.4.6, 1.5.6, and 1.6.0‑beta.5 the application incorrectly validates the `dest` parameter after a login attempt, allowing a string that contains a backslash to be treated as a relative URL. Browsers normalise that backslash to a forward slash, so the destination is emitted unchanged in the HTTP Location header, causing the browser to navigate to a domain controlled by the attacker. This produces a classic open‑redirect flaw that can be used with phishing or social‑engineering attacks.

The vulnerability affects all default Saltcorn installations using the vulnerable releases. Vulnerable versions include any release earlier than 1.4.6 for the 1.4 series, earlier than 1.5.6 for the 1.5 series, and earlier than 1.6.0‑beta.5 for the 1.6 series. No explicit workaround is listed; the issue is fixed in the aforementioned patched releases.

The CVSS score of 5.1 classifies the flaw as medium severity. The EPSS score is not available, and it is not listed in the CISA KEV catalog. Based on the description, it is inferred that the issue can be exploited from the public web interface; an attacker only needs to craft a malicious URL that includes a backslash‑escaped domain and trick a user into clicking the resulting login link. The lack of a complex prerequisite or elevated privileges makes this attack plausible for adversaries with limited resources.