OAuth‑proxy fails to validate the destination redirect parameter (`rd`) during post‑login redirection, allowing a remote attacker to craft a link that redirects an authenticated user to any external site. This open redirect can be used to trick users into phishing sites or steal credentials after authentication. The flaw is a CWE‑601 improper input validation issue that permits unintended URL redirects. The vulnerability is limited to the oauth‑proxy component and does not affect other components directly.

The affected component is the oauth‑proxy middleware, used within Red Hat OpenShift Container Platform 4. The CVE affects this platform; no specific product version details beyond the major release 4 are provided, so the scope of installations that might be impacted cannot be precisely determined from the current information.

The CVSS score of 6.1 indicates moderate severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is through crafted post‑login redirect URLs that exploit the bypass of the original validation logic; exploitation would require that the target environment employs the vulnerable redirect logic in oauth‑proxy.