The vulnerability in Milk admin (<=0.9.8) involves improper validation of the redirect parameter, enabling remote attackers with high privileges to craft requests that redirect users to arbitrary external URLs. This open redirect vulnerability (CWE-601) can be exploited to redirect users unexpectedly, potentially facilitating phishing or other social engineering attacks. The CVSS 3.1 vector indicates network attack vector, low attack complexity, high privileges required, no user interaction, unchanged scope, no confidentiality or integrity impact, and high availability impact.

The vulnerability allows attackers with high privileges to cause user redirection to arbitrary external URLs. While it does not compromise confidentiality or integrity, it may disrupt availability or user trust by redirecting to malicious sites. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to trusted users with high privileges and monitor for suspicious redirect parameter usage.