The vulnerability CVE-2024-4604 affects Magarsus Consultancy's SSO product version 1.0 and earlier before 1.1. It is classified as CWE-601, an Open Redirect issue, where attackers can manipulate hidden fields in the SSO process to redirect users to untrusted external URLs. This could potentially lead to phishing or other social engineering attacks by exploiting the trust in the legitimate SSO service. The CVSS 3.1 vector indicates network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, with low confidentiality and integrity impacts and no availability impact.

The vulnerability allows attackers to redirect users to untrusted sites by manipulating hidden fields in the SSO process. This could facilitate phishing attacks or other malicious redirections, potentially compromising user trust and exposing users to further attacks. The impact is limited to confidentiality and integrity with no direct availability impact. There are no known active exploits reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or fix is currently documented, users of affected versions should monitor vendor communications for updates. Until a fix is available, consider implementing additional controls such as validating redirect URLs on the application side or restricting redirects to trusted domains if possible.