Probo’s saferedirect validator incorrectly inspected only the second character of relative paths, letting URLs like "/../\evil.com" pass validation. HTTP path normalization turns the backslash into a host separator, so browsers redirect users to an external domain. This flaw enables phishing by allowing attackers to embed malicious URLs in ‘continue’ parameters or session‑transfer tokens that appear to originate from a trusted Probo domain.

The vulnerability exists in any self‑hosted instance of Probo whose version is older than 0.194.1. SaaS deployments on getprobo.com have been patched. Users running Probo prior to v0.194.1 should update to flash any potential exploitation vectors.

The CVSS score of 4.7 places the flaw in the moderate range. No exploit probability data is presently available, and the vulnerability is not listed in CISA KEV. An attacker requires user interaction to trigger the redirect, typically by directing a victim to a crafted link containing a backslash sequence. Browsers that interpret the backslash as a host separator expose users to phishing where the victim believes the redirect originates from a trusted domain.