The vulnerability resides in the unstable_redirect helper of the Waku JavaScript framework, which reflects a supplied string directly into the HTTP Location header without any validation. An attacker who supplies controlled input can cause browsers to navigate to any external domain, facilitating phishing, credential harvesting, and OAuth token theft. The flaw allows scheme‑relative URLs, bypassing simple https?:// filters that developers may implement. This represents an information‑disclosure and remote‑execution risk for users clicking crafted links.

The vulnerability affects applications built with the wakujs waku framework that use the unstable_redirect helper before version 1.0.0‑beta.1. Specifically, code in packages/waku/src/router/define‑router.tsx referencing the helper is vulnerable. All users of earlier releases of the framework are impacted until they upgrade to 1.0.0‑beta.1 or later. No other products are listed in the current advisory.

The CVSS base score is 3.1, indicating a low severity impact. EPSS is currently unavailable, so the precise likelihood of exploitation cannot be quantified, but the presence of a functional exploit in the public source tree suggests non‑negligible risk. The vulnerability is not listed in CISA KEV. Attackers would need to embed a redirect call in an application’s reachable route; the user’s click is the primary prerequisite. The lack of redirects validation makes exploitation straightforward once the pattern is used.