This vulnerability in Red Hat OpenShift Container Platform 4's oauth-server component involves improper validation of the 'then' parameter in the grant approval handler, leading to an open redirect. When an authenticated user approves or denies a grant request, they can be redirected to an attacker-controlled website. Although this can enable phishing attacks by tricking users into revealing sensitive information, the vulnerability does not expose OAuth tokens, authorization codes, or session credentials. Red Hat has classified the severity as low and has not provided a patch or mitigation, noting that the risk is limited to phishing.

The impact is limited to enabling phishing attacks by redirecting users to malicious websites after OAuth consent prompts. No direct compromise of OAuth tokens, authorization codes, or session credentials occurs. Users may be tricked into revealing sensitive information on attacker-controlled sites. There is no impact on confidentiality, availability, or integrity of the OAuth tokens themselves. The vulnerability does not allow privilege escalation or direct system compromise.

Red Hat states there is no mitigation available for this flaw. The risk is limited to phishing attacks enabled by the open redirect, and no OAuth tokens or credentials are exposed. Users and administrators should be aware of the phishing risk but no official fix or workaround is currently provided. Monitor the Red Hat advisory for any future updates regarding remediation.