An issue in Webasyst Framework 4.0.3 and earlier allows a remote attacker to create a crafted OAuth authorization URL containing an arbitrary redirect_uri parameter, which the system processes without proper validation. This flaw can lead to execution of code supplied by the attacker on the target server, compromising confidentiality, integrity, and availability of the application and any connected services. The vulnerability is identified as CWE‑601, an Open Redirect weakness that becomes a code execution vector when the redirect_uri is improperly handled.

Any deployment of Webasyst Framework 4.0.3 or earlier is susceptible. The advisory does not list specific editions or add‑ons, so all installations running these versions should be considered vulnerable until updated or mitigated.

The CVSS score of 8.1 indicates a high severity exploit, while the EPSS score of less than 1% indicates that, although exploitation is technically feasible, it is currently considered unlikely. The vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is a web‑based OAuth request; an attacker can supply a malicious redirect_uri to a victim via a link or email, compelling the victim to interact with the OAuth endpoint. No local privileges are required, and the flaw can be leveraged remotely once the victim visits the crafted URL.