An open redirect vulnerability (CWE-601) exists in the social login feature of pretix Venueless. The application fails to properly validate redirect URLs, allowing attackers to craft URLs that redirect users to untrusted external sites. This can be leveraged in phishing attacks to exploit user trust in the legitimate domain. The vulnerability has been assigned CVE-2026-12863 with a CVSS 4.0 base score of 5.1, indicating medium severity. No vendor advisory or patch information is currently available, and the affected version is listed as 0.0.0, which likely indicates an unspecified or initial version.

Successful exploitation of this vulnerability could enable attackers to redirect users to malicious websites via the social login functionality, facilitating phishing attacks. This could lead to user credential theft or other social engineering impacts. There is no indication of direct code execution or data compromise from this vulnerability alone.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should exercise caution with URLs involving the social login feature and consider implementing additional validation or user warnings for redirects. Monitor vendor communications for updates.