The flaw is an open redirect in the client portal login that lets attackers insert a malicious URL into the intended parameter. After a victim authenticates, the application blindly redirects them to the URL stored in the session, enabling phishing and credential‑stealing attacks without requiring additional privileges.

Invoice Ninja versions up to and including 5.13.26 are affected. The vulnerability resides in the client portal login flow of the Invoice Ninja application.

The CVSS score of 5.3 indicates a moderate threat. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog. Attackers can exploit the flaw remotely by constructing a login link that contains a malicious intended parameter, so the likely attack vector is web-based, relying on unauthenticated access to the login page.