CVE-2026-33213 is an open redirect vulnerability (CWE-601) in the get_next_path() function of Redash's authentication module. The function attempts to sanitize the 'next' parameter by removing scheme and netloc components but does not normalize multiple leading slashes. This flaw allows an attacker to craft a login URL with a 'next' parameter containing multiple leading slashes (e.g., ////evil.com), which bypasses the sanitization and causes the application to redirect users to an external, attacker-controlled site after login. This affects Redash versions prior to 5.0.2 and up to and including 26.3.0. The vulnerability is rated medium severity with a CVSS 3.1 score of 6.1.

Successful exploitation can cause users to be redirected to malicious external websites after authentication, potentially leading to phishing or other social engineering attacks. The vulnerability impacts confidentiality and integrity to a limited extent but does not affect availability. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should avoid using affected versions or implement strict validation and normalization of the 'next' parameter to prevent multiple leading slashes that enable open redirects.