A client‑side plugin in NocoDB uses window.location.replace to act on a URL fragment that begins with a forward slash. The plugin validates only that the fragment starts with "/", which also accepts protocol‑relative URLs such as //attacker.com/. When such a fragment is present, the browser interprets it as a relative path and redirects the browser to the attacker’s site without user awareness. This vulnerability is a CWE‑601 open redirect flaw. The flaw does not provide code execution or direct control, but it can lead to phishing, credential theft, or drive‑by downloads through social‑engineering of users who click a malicious link.

The vulnerability exists in the NocoDB application itself, specifically in versions released before 2026.04.1. NocoDB is developed by nocodb and the affected product is the full application where the hashRedirect plugin is enabled.

The CVSS score of 5.1 indicates moderate severity; EPSS data is not available, and the issue is not listed in CISA’s KEV catalog. Exploitation requires only a crafted link containing a hash fragment that points to a protocol‑relative URL; any user who clicks the link will be redirected. No special privileges are needed, and the attack relies mainly on social‑engineering or phishing vectors. The risk lies mainly in the loss of user trust and potential credential compromise rather than direct compromise of the host system.