OpenMetadata lacks validation of post‑authentication redirect targets. The SAML and OIDC handlers concatenate the supplied redirect URI with an issued JWT and then redirect the user to that URI. The resulting URL contains the JWT, the user’s email, and name, which fully authenticates API calls. If an attacker controls the target domain, they can capture the JWT and impersonate the user. This flaw is a classic Open Redirect coupled with token leakage (CWE‑601) and enables account takeover.

Vendors include open-metadata and product OpenMetadata. All releases prior to version 2.0.0 expose this vulnerability; no 1.x release validates the callback parameter, whereas 2.0.0 removes it.

The CVSS score of 8.5 indicates high severity. Because the attack requires a user to authenticate and then follow a malicious redirect, exploitation is primarily social‑engineering via phishing or compromised sites. No exploitation data is listed in the KEV catalog, and EPSS information is not available, but the flaw’s design implies it is actionable by threat actors. The potential impact is complete loss of account control for any authenticated user who follows such a link.