An open redirect vulnerability (CWE-601) exists in the social login feature of pretix's Venueless product. The vulnerability allows an attacker to craft URLs that redirect users to arbitrary external sites without proper validation. This can be leveraged for phishing attacks by exploiting the trust users place in the legitimate domain. The CVSS 4.0 vector indicates network attack vector, low attack complexity, low privileges required, user interaction needed, and limited impact on confidentiality and integrity. The affected version is stated as =0.0.0, but no further version details or patches are provided.

Successful exploitation could lead to phishing attacks where users are redirected to malicious sites from a trusted domain, potentially resulting in credential theft or other social engineering outcomes. There is no indication of direct compromise of the Venueless system or data integrity loss. The impact is primarily on user trust and potential phishing risk.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users and administrators should be cautious with URLs involving the social login functionality and educate users about the risk of phishing via open redirects. Monitoring for updates from pretix regarding this vulnerability is recommended.