The vulnerability is an open redirect in Active Directory Federation Services that allows an authorised attacker to redirect users to untrusted sites, enabling spoofing attacks and potential credential theft. It is a CWE‑601 weakness that does not provide remote code execution but can subvert user trust and lead to phishing.

Microsoft Windows 10 Version 1607 and Version 1809, Microsoft Windows Server 2016 (including Server Core), Microsoft Windows Server 2019 (including Server Core), Microsoft Windows Server 2022, and Microsoft Windows Server 2025 (including Server Core).

The CVSS score of 4.8 indicates moderate severity, and the vulnerability is not currently listed in CISA's KEV catalog. Exploitation requires the attacker to be an authorised AD FS user and to construct a URL that triggers the redirect; once successful, the attacker can spoil authentication flows and lure users to malicious sites. While the attack is limited to authorised users, it still poses a significant risk in environments where user trust is critical, so applying the vendor patch is strongly recommended.