FOSSBilling's Redirect module, prior to version 0.8.0, fails to validate the scheme of administrator‑configured URLs before storing them. Attackers with admin rights can set any external URL as a redirect target, resulting in a 301 redirect that silently forwards legitimate users to attacker‑controlled sites. This open redirect can be used for phishing by disguising malicious landing pages as trusted FOSSBilling URLs. The flaw is an instance of CWE‑601.

The vulnerability affects the FOSSBilling product from the FOSSBilling vendor. Any deployment running a release earlier than 0.8.0 is vulnerable, as those versions lack the URL scheme validation in the Redirect module.

Exploitation requires administrator privileges to create or modify redirect entries, limiting the attack surface to multi‑admin environments or compromised admin accounts. The CVSS score of 4.8 indicates moderate severity, and lack of a KEV listing suggests the vulnerability is not currently known to be widely exploited. Because the redirect uses a 301 response, browsers cache the target, which can amplify the phishing impact. Attackers would need to gain admin access or use an existing compromised admin account to configure the harmful redirect.