The OAuth/OIDC authentication implementation in the Axivion Dashboard does not properly restrict post-authentication redirects to the application's own origin. As a result, an attacker can craft login URLs that redirect authenticated users to external, untrusted sites. This open redirect vulnerability (CWE-601) can be abused for phishing attacks by making malicious links appear to originate from the legitimate Dashboard. The vulnerability affects Axivion versions 7.8.0 through 7.12.0. There is no official remediation or patch currently documented.

Successful exploitation can lead to phishing attacks where users are redirected to attacker-controlled sites after authenticating on the legitimate Dashboard. This can result in credential theft or second-factor authentication token compromise if users are tricked into entering sensitive information on look-alike pages. The vulnerability requires user interaction and does not allow direct system compromise or privilege escalation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users and administrators should be cautious of unsolicited or suspicious login links and educate users about the risk of phishing via open redirects. Monitoring for unusual login URLs and restricting external redirects if configurable may help reduce risk.