The login flow of the Roxy‑WI interface permits a next parameter that, when malformed, can redirect users to an attacker‑controlled domain. URLs are filtered for literal http:// or https:// substrings, but the userinfo@host pattern is not detected. An attacker supplies a value such as @evil.example/path; the server concatenates it with the configured host to form https://victim.example@evil.example/path, which modern browsers interpret as a reference to evil.example. This flaw, classified as CWE‑601, enables attackers to redirect users to phishing sites or other malicious destinations.

Versions of Roxy‑WI up to and including 8.2.6.4 are affected. The vulnerability originates in the web interface for managing Haproxy, Nginx, Apache and Keepalived servers provided by the Roxy‑WI vendor.

The CVSS score of 6.1 indicates moderate severity. No EPSS score is available and the instance is not listed in the CISA KEV catalog, suggesting limited or no active exploitation yet. Triggering the redirect requires only the construction of a crafted URL. The CVE description does not specify whether authentication is required for the redirect. Because the redirect occurs client‑side, the threat operates through user interaction and can be leveraged in phishing campaigns, but it does not compromise server state directly.