Angular SSR versions on the 22.x branch before 22.0.0-next.2, 21.x before 21.2.3, and 20.x before 20.3.21 contain an Open Redirect vulnerability (CWE-601) due to incomplete validation of the X-Forwarded-Prefix header. The original fix for CVE-2026-27738 blocked multiple leading slashes but did not account for a single backslash, which browsers interpret as a protocol-relative URL, enabling redirection to attacker-controlled sites. Additionally, the lack of a Vary: X-Forwarded-Prefix header allows malicious redirects to be cached by intermediaries. The vulnerability is fixed in versions 22.0.0-next.2, 21.2.3, and 20.3.21.

An attacker can exploit this vulnerability to redirect users of Angular SSR applications to malicious websites by manipulating the X-Forwarded-Prefix header. This can lead to phishing or other social engineering attacks. The absence of the Vary header also enables web cache poisoning, potentially affecting multiple users. The CVSS score is 6.9 (medium severity), indicating a moderate risk without requiring user interaction or privileges.

A patch is available in Angular SSR versions 22.0.0-next.2, 21.2.3, and 20.3.21. Users should upgrade to these or later versions to remediate the vulnerability. Until patched, developers should sanitize the X-Forwarded-Prefix header in their server.ts files before processing requests with Angular SSR. This manual mitigation helps prevent exploitation by filtering or validating the header value.