Scoold authentication provided vulnerability in the getBackToUrl() routine where the backTo and returnto query parameters were validated by checking a hostname prefix against the configured server URL. An attacker can supply an absolute URL whose hostname begins with the legitimate hostname, tricking URI.resolve() into accepting the attacker’s URL. The result is that a victim who follows a crafted sign‑in link will be redirected to a phishing site after authentication, allowing credential or token theft. The flaw is a classic open‑redirect weakness (CWE‑601).

Erudika Scoold, versions prior to 1.69.1. Any instance running 1.68.x or earlier is potentially vulnerable because the getBackToUrl() method has not been fixed until release 1.69.1.

The CVSS score of 5.4 indicates moderate severity. EPSS data is not available, and the vulnerability is not currently listed in CISA’s KEV catalog, suggesting limited widespread exploitation. The likely attack vector is a web‑based phishing campaign that utilizes a malicious sign‑in URL sent to users. Exploitation requires only that an attacker constructs a valid URL containing the legitimate hostname prefix and that the victim follows it. Once the victim authenticates, the vulnerable redirect logic sends them to the attacker’s domain.