The flaw permits attackers to craft requests that redirect users to any external URL. This open redirect flaw is identified as CWE‑601. While the vulnerability does not provide code execution or direct data exfiltration, it can be used to steer users to malicious sites, potentially resulting in phishing or credential phishing.

Affected product is Search Guard FLX (floragunn), a Kibana plugin. Versions through 4.0.1 include the issue. Version 4.1.0 and later contain the fix. The product is available for all platforms per the CPE entry.

CVSS score 4.3 indicates moderate severity. EPSS below 1 % suggests low exploitation likelihood in the wild. The vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that authentication is not required to trigger the redirect; any client that can reach the Search Guard‑protected Kibana instance may craft the malicious request. Consequently, the potential attack surface is broad. Exploitation requires only sending a crafted request, which can be performed via a web browser or automated tools once the target URL is exposed.