CVE-2025-71405 is an open redirect vulnerability in the go-chi chi web framework affecting versions prior to v5.2.2. The issue is located in the RedirectSlashes middleware function, which improperly uses the Host header to build redirect URLs. An attacker can exploit this by manipulating the Host header to redirect users to arbitrary, potentially malicious hosts. This vulnerability can be leveraged for phishing and credential theft attacks. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges required, user interaction required, and low impact on confidentiality and integrity.

Successful exploitation allows attackers to redirect users to untrusted external sites, potentially enabling phishing attacks and theft of user credentials. The vulnerability does not require privileges or authentication but does require user interaction. The impact on confidentiality and integrity is low, and there are no known active exploits in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should be cautious about relying on the RedirectSlashes middleware with untrusted input and consider implementing additional validation or controls on redirect URLs to prevent open redirects.