The vulnerability in Webasyst Framework before version 4.0.4 allows a remote attacker to craft an OAuth authorization URL with an arbitrary redirect_uri parameter and trigger arbitrary code execution on the target system. The flaw arises from insufficient validation of the redirect_uri supplied during the OAuth flow, enabling the attacker to inject malicious input that is ultimately executed by the server. The primary impact is the loss of confidentiality, integrity, and availability for affected installations, potentially allowing attackers to take full control of the compromised application and any connected backend services.

Any deployment of Webasyst Framework version 4.0.3 or earlier is affected. The CVE description does not specify particular editions or add-ons, so all installations using these versions may be vulnerable unless mitigated.

The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is a web‑based OAuth request; an attacker can direct a victim to a crafted authorization URL by e.g. an email or a malicious link. The exploitation requires the victim to interact with the OAuth endpoint, but no local permission is needed. Consequently, the risk remains significant for exposed systems that accept OAuth requests.