This vulnerability involves an open redirect in the /api/google/authorize endpoint of hunvreus DevPush v0.3.2. Attackers can manipulate the URL parameter to redirect users to arbitrary external websites, potentially facilitating phishing or other social engineering attacks. No CVSS score or detailed impact metrics are provided, and no official fix or mitigation has been disclosed.

The primary impact is the potential for user redirection to malicious sites, which could lead to phishing or other social engineering attacks. There is no information about direct compromise of the application or data leakage. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users and administrators should be cautious with URLs involving the /api/google/authorize endpoint and consider implementing input validation or URL filtering as a temporary measure.