The vulnerability arises from insufficient validation of the user-configurable homepage setting in MISP. The system only verifies that the supplied path begins with a forward slash; this allows protocol-relative URLs like //attacker.example to pass validation. When a logged‑in user is redirected using the stored homepage value, browsers resolve the protocol-relative URL to an external domain, enabling attackers to coerce authenticated users to malicious sites, facilitating phishing or credential theft. The weakness corresponds to input validation failures (CWE‑20) and open redirect conditions (CWE‑601).

MISP (MISP) versions up to and including 2.5.45. Any installation of MISP that has enabled user-configurable homepage URLs is susceptible.

The CVSS score of 5.1 indicates moderate severity. No EPSS score is published, and the vulnerability is not currently listed in CISA's KEV catalog, suggesting a limited public exploitation history. The exploit requires an authenticated user account that has set a homepage URL. An attacker can redirect that user to a malicious site by crafting a protocol-relative URL, which is then emitted to the Location header after login. Because the attacker only needs to set the value in a user account, the risk is moderate but potentially high in environments where users share credentials or inadvertently grant privileged access.