Kargo allows attackers to supply a misleading redirectTo query parameter in the UI OIDC login flow. The parameter is not validated, enabling an attacker to transfer the user to an arbitrary URL after authentication. This flaw can be leveraged for phishing or other malicious landing pages, potentially leading to credential theft or malware delivery. The issue is a classic open redirect weakness (CWE‑601).

The vulnerability affects Akuity Kargo versions prior to 1.7.10, 1.8.13, 1.9.8, and 1.10.2. All earlier releases contain an unvalidated redirectTo parameter in the login endpoint. Upgrading to the specified patched releases resolves the issue.

The CVSS score of 5.1 indicates a medium impact level. No EPSS score is available, and the flaw is not listed in the CISA KEV catalog. Attackers can exploit the flaw by crafting a login URL containing a malicious redirectTo value; no special privileges or credential compromise are required to trigger the redirect. Given the ease of constructing such a URL, the risk to users remains moderate but should be addressed promptly.