h3 versions before 2.0.1-rc.18 have a client‑side open‑redirect flaw in the redirectBack() utility. The function fails to sanitize protocol‑relative paths found in the Referer header pathname, allowing attackers to craft a same‑origin URL that passes origin validation but causes the browser to interpret a Location header as a protocol‑relative redirect to an external domain. The flaw can be used to lure users to phishing sites or inject malicious content via browser navigation, compromising user confidentiality and potentially facilitating credential theft.

The vulnerability affects all installations of the h3 JavaScript library from vendors such as h3js before version 2.0.1-rc.18. Any deployment using earlier releases of h3 is susceptible until it is updated to a fixed build.

The CVSS score of 5.3 reflects moderate severity; exploitation requires only a crafted link and does not need authentication or elevated privileges. With no EPSS data, precise exploit frequency cannot be quantified, but the flaw is listed as not part of the CISA KEV catalog. Attackers can embed a double‑slash path segment in the Referer header to trick browsers into performing a protocol‑relative redirect, enabling phishing or other social‑engineering attacks. The ease of injection and the lack of remediation controls by default make this a readily exploitable weakness in permissive web applications.