CVE-2026-33885 is an open redirect vulnerability in Statamic CMS affecting versions before 5.73.16 and between 6.0.0.alpha.1 and 6.7.2. The vulnerability arises because the external URL detection mechanism used to validate redirects on unauthenticated endpoints can be bypassed. This flaw permits an attacker to redirect users to arbitrary external URLs following certain user actions like form submissions or authentication processes. The vulnerability is addressed in Statamic CMS versions 5.73.16 and 6.7.2.

Successful exploitation of this vulnerability allows an attacker to redirect users to untrusted external websites, which can be used in phishing attacks or to deliver malicious content. The CVSS score of 6.1 (medium severity) reflects the potential for limited confidentiality and integrity impact without direct system compromise or denial of service.

Upgrade Statamic CMS to version 5.73.16 or later, or 6.7.2 or later, where the open redirect vulnerability has been fixed. No other specific mitigations are indicated by the vendor advisory. Patch status is confirmed by the version fixes noted in the description.