This vulnerability in HotelRunner B2B involves an open redirect issue where URLs can be manipulated to redirect users to untrusted external sites. The affected versions are all prior to 04.06.2025. The CVSS 3.1 vector indicates the attack can be performed remotely without privileges, requires user interaction, and impacts integrity with a scope change but no confidentiality or availability impact. No patch or vendor advisory is currently available to confirm remediation status.

The primary impact is the potential for users to be redirected to malicious external websites, which could facilitate phishing or other social engineering attacks. The integrity of user navigation is affected, but there is no direct confidentiality or availability impact reported. No known active exploitation has been documented.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users and administrators should be cautious with URLs received from untrusted sources and consider implementing internal URL validation or filtering if possible.