IBM WebSphere Application Server versions 8.5 and 9.0 contain a CWE-601 open redirect vulnerability. An attacker can exploit this by persuading users to visit specially crafted URLs that appear to be legitimate but redirect to untrusted malicious sites. This vulnerability enables phishing attacks by spoofing the URL displayed to the user, potentially leading to information disclosure or additional attacks.

Successful exploitation allows attackers to redirect users to malicious websites while appearing as trusted URLs, increasing the risk of phishing attacks and potential exposure of sensitive information. There is no indication of direct system compromise or denial of service from this vulnerability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should be cautious of suspicious URLs and consider implementing URL validation or filtering controls to mitigate open redirect risks.