The vulnerability lies in nforwardauth’s /login endpoint, which accepts an unvalidated r query parameter and uses it as the post‑authentication redirect. An attacker can craft a legitimate login URL that, after a user authenticates, redirects to an attacker‑controlled site. The issue is an open redirect (CWE-601) that may enable phishing or social-engineering attacks by exploiting trust in the authentication domain, but it does not provide an unauthenticated bypass of the service.

This issue affects the nosduco nforwardauth service, specifically all versions earlier than v1.5.1.

The CVSS base score of 6.1 indicates moderate severity, and EPSS data is unavailable while KEV does not list it. An attacker can exploit the flaw remotely simply by distributing a malicious login URL, requiring no special privileges and only leveraging legitimate authentication flows. The risk is therefore primarily in the potential for social‑engineering attacks rather than brute force or privilege escalation.