The vulnerability allows attackers to craft URLs that cause CIAS to redirect users to arbitrary external destinations. This open‑redirect flaw (CWE‑601) can be exploited to facilitate phishing or credential‑harvesting attacks, compromising user trust and potentially leading to credential compromise if users enter authentication information on malicious sites.

Drupal Central Authentication System (CAS) Server versions from 0.0.0 through 2.0.4 and 2.1.0 through 2.1.3 are affected. These include all deployments that rely on the CAS module for single‑sign‑on and identity federation.

The EPSS score is <1%, indicating a very low but nonzero exploitation probability. The CVSS score of 6.5 classifies this as a moderate severity vulnerability and the vulnerability is not listed in CISA KEV, indicating limited publicly known exploitation. The risk level is moderate because the flaw requires a user to interact with a crafted link, but attackers can distribute such links widely. The likely attack vector is through a malicious link presented in phishing emails or compromised web content that points to the vulnerable CAS server.