Rodauth before 2.47.0 does not validate protocol‑relative return‑to paths in the confirm_password, login_return_to_requested_location, and two_factor_auth_return_to_requested_location features. The flaw permits attackers to craft URLs that begin with two slashes, which browsers interpret as protocol‑relative URLs. When an authenticated user completes login or password confirmation, the application redirects them to the attacker‑controlled site, enabling phishing or credential disclosure attacks. This vulnerability is classified as CWE‑601 – Open Redirect.

The affected product is Rodauth released by jeremyevans. All releases before version 2.47.0 contain the vulnerability. Sites that use the confirm_password, login_return_to_requested_location, or two_factor_auth_return_to_requested_location features are potentially impacted.

The CVSS score of 4.9 indicates a medium severity. EPSS is not available and the flaw is not listed in the CISA KEV catalog, suggesting a relatively low exploitation probability at present. The attack vector requires a web application context; an attacker needs to influence an authenticated user’s browser after a legitimate login or password action. If successful, the attacker can redirect the user to a malicious site, potentially leading to phishing or credential theft. The overall risk is moderate, warranting timely remediation.