The vulnerable HTTP plugin performs URL validation against an allowlist only on the initial request. If the remote server responds with a 3xx redirect, the plugin follows the redirect internally without re‑checking the new target. An attacker who controls an allowed URL or finds an open redirect on an allowed host can thus have the application reach disallowed destinations such as cloud‑metadata endpoints, localhost services, or other internal network hosts. This flaw enables a server‑side request forgery that can expose sensitive data or internal services to an attacker.

Products affected are the Tauri framework’s tauri-plugin-http ranging from version 2.0.0 up to and including 2.6.1. Versions 2.7.0 and later contain the fix, but the new scopeRedirects setting must be enabled to enforce per‑hop validation.

The CVSS score is 5.6, indicating medium severity. No EPSS score is available and the vulnerability is not listed in CISA KEV. An attacker needs control over an allowed host or the ability to craft an open redirect on one. When exploited, the impact may include access to internal services and sensitive data. While exploitation probability is not quantified, the flaw is actionable and should be addressed promptly.