Cotonti through version 1.0.0 contains an open redirect vulnerability (CWE-601) in message.php. The redirect parameter is base64-decoded but lacks domain validation, enabling unauthenticated attackers to create malicious URLs that redirect users to arbitrary external websites using meta refresh tags. This behavior can be leveraged for phishing attacks. The vulnerability has a CVSS 3.1 score of 6.1, indicating medium severity. No known exploits in the wild or patch information is currently available.

An attacker can redirect users to arbitrary external websites by exploiting the open redirect vulnerability, potentially facilitating phishing attacks. The vulnerability requires no authentication and can be triggered via crafted URLs. The impact includes limited confidentiality and integrity loss due to user redirection, but no direct system compromise or availability impact is indicated.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users and administrators should be cautious about links involving the redirect parameter in message.php. Consider implementing external mitigations such as user education about suspicious links and URL filtering at the network level.