Concourse, a container-based automation platform, contains an open redirect flaw in its login flow. An attacker can craft a URL that, when visited, redirects the user from the Concourse web interface to an arbitrary external site. This capability can be abused in phishing attacks to lure users into entering their credentials on a malicious site, resulting in credential theft. The flaw is classified as CWE-601, a web application open redirect weakness.

The vulnerability affects all Concourse installations running versions earlier than 8.2.3. The issue was fixed in release 8.2.3 and later. Any instance that exposes the Concourse web interface to unauthenticated users is potentially exposed.

The EPSS score is not available and the vulnerability is not listed in CISA KEV, indicating no publicly attested exploit. Nonetheless, the exploitability is straightforward: an attacker only needs to craft a redirect URL and send it to a target user via email or other communication. The risk is high for systems that allow unauthenticated access to the login page, as users could be compromised without additional credential-oriented attacks.