The installer-generated Apache configuration incorrectly formats an HTTP‑to‑HTTPS redirect by omitting a trailing slash after the MISP host. When a user follows the redirect, the requested path is appended directly to the destination URL. Because the destination lacks a terminating slash, the appended path is interpreted by browsers as user information and the following segment as a host name, resulting in a URL like https://misp.example@attacker.example/. This redirects users to an attacker‑controlled site, allowing phishing, credential harvesting, or leakage of query‑string data that accompanies the redirect. The flaw is a classic open‑redirect issue (CWE‑601) that only requires an unauthenticated remote user to click a crafted link.

All MISP installations that employ the default installer and generate Apache virtual‑host configurations contain this redirect. No specific version range is supplied in the advisory; any installation using the affected script should be examined.

With a CVSS score of 7.8 the vulnerability is considered moderate‑high severity. The EPSS score is below 1 %, indicating a low probability of exploitation in the wild. It is not presently listed in the KEV catalog. Exploitation requires manual user interaction—an attacker constructs a malicious URL within the legitimate MISP domain, hoping a user clicks it. Successful exploitation can lead to phishing and credential theft without privilege escalation.