This vulnerability (CWE-601) in HCL Digital Experience & DX Compose 9.5 allows an attacker to manipulate the Host header, resulting in an open redirect to untrusted sites. The issue arises from insufficient validation of the Host header, enabling redirection to arbitrary external URLs. The CVSS 3.1 score is 6.1 (medium), reflecting network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and low impact on confidentiality and integrity with no impact on availability.

Successful exploitation can cause users to be redirected to untrusted or malicious websites, potentially facilitating phishing or other social engineering attacks. The confidentiality and integrity impacts are low, and availability is not affected. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary mitigation has been documented. Until a patch is available, users should be cautious of unexpected redirects and consider implementing application-level validation of Host headers if possible.