GHSA-g7gw-m874-7rmf

## Summary

The Kargo UI reads a `redirectTo` query parameter on the `/login` and `/token-renew` routes and, following a successful OIDC authentication, uses its value as the destination for client-side navigation. The parameter is treated as a path string but is not constrained to targets within the UI's own origin. Protocol-relative values (e.g. `//attacker.example.com`) and values using a backslash prefix (e.g. `/\attacker.example.com`) are accepted and result in navigation to an external origin.

An attacker can exploit this by crafting a URL of the form `https://kargo.example.com/login?redirectTo=/token-renew?redirectTo=/\attacker.example.com` and delivering it to a victim through any channel that permits link sharing. When the victim follows the link and signs in to Kargo, the browser is redirected to the attacker-controlled origin. Because the initial URL resolves to the legitimate Kargo host and the user is genuinely authenticated in the process, the redirect inherits the perceived trust of the user's own Kargo instance.

The principal risk is that such a redirect can serve as a stepping stone for credentials phishing. The attacker-controlled page can present a UI resembling Kargo or an associated identity provider and solicit credentials from the user. The vulnerability does not, by itself, expose any data from Kargo or permit modification of Kargo resources, and it does not affect authentication when Kargo's built-in admin credentials are used.

## Base Metrics

The following sections provide the rationale for the values selected for each of CVSS v4's base metrics. The resulting vector is `CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N`, which scores 0.0 (None). This reflects a known limitation of CVSS v4: the standard scopes impact to direct consequences of exploitation, and so does not capture vulnerabilities whose operational significance lies in enabling multi-step attacks. The open redirect here fits that pattern — its immediate effect is benign navigation, and any meaningful harm depends on additional attacker-controlled infrastructure and voluntary actions by the victim. Kargo classifies this vulnerability's severity as Low on a qualitative basis, reflecting the real but bounded operational risk that open redirects pose.

### Attack Vector (AV): Network

The Kargo UI is served by the Kargo API server over HTTP/HTTPS. No local, adjacent network, or physical access is required.

### Attack Complexity (AC): Low

Exploitation requires only a crafted URL. No race conditions, non-default configurations, or prior information gathering are required.

### Attack Requirements (AT): None

No specific environmental conditions are required beyond a Kargo deployment configured for OIDC authentication, which is the expected configuration for any non-development deployment.

### Privileges Required (PR): None

The attacker does not need to authenticate to Kargo or hold any permissions. The victim's own authentication completes the redirect.

### User Interaction (UI): Active

Exploitation requires a victim to follow the crafted link and then complete the OIDC sign-in flow. Absent this interaction, no redirect occurs.

### Confidentiality Impact to Vulnerable System (VC): None

The vulnerability does not expose any data from the Kargo control plane.

### Integrity Impact to Vulnerable System (VI): None

The vulnerability does not permit modification of any data or configuration within Kargo.

### Availability Impact to Vulnerable System (VA): None

The vulnerability does not provide any mechanism for denial of service against Kargo.

### Confidentiality Impact to Subsequent Systems (SC): None

The direct consequence of exploitation is navigation to an attacker-controlled URL. Any resulting compromise of the victim's credentials or other data requires the attacker to stage a convincing phishing page and the victim to voluntarily submit information to it — neither action is performed by the exploit itself. CVSS v4 scopes impact to direct consequences of exploitation, so the enabled phishing scenario is not reflected here.

### Integrity Impact to Subsequent Systems (SI): None

The vulnerability does not modify any data on downstream systems. Tampering an attacker might perform using credentials phished via the enabled redirect would be a consequence of a follow-on attack, not of this vulnerability.

### Availability Impact to Subsequent Systems (SA): None

The vulnerability does not provide any mechanism to degrade the availability of downstream systems.

## Mitigating Factors

- Exploitation is contingent on social engineering. A victim must both follow the crafted link and complete an authentication flow for the redirect to fire.

- The vulnerability does not directly compromise Kargo or expose any Kargo-held data. Impact is limited to enabling an attacker-controlled destination to be reached via a legitimate Kargo URL.

- There is no evidence of exploitation in the wild.