Horilla-hr versions up to 1.5.0 contain an open redirect vulnerability (CWE-601) in their notification endpoints. The application accepts a 'next' parameter without proper validation and redirects users to the URL specified by this parameter. This behavior can be abused by attackers to redirect users from trusted horilla-hr links to malicious external websites, facilitating phishing or social engineering attacks. The CVSS 4.0 base score is 4.8 (medium severity), reflecting network attack vector, low complexity, no privileges required, but user interaction needed. There is no vendor advisory or patch information available, and the product is not a cloud service, so remediation status is currently unknown.

Successful exploitation allows attackers to redirect users from legitimate horilla-hr notification links to arbitrary external URLs. This can lead to phishing or social engineering attacks leveraging the trust in the original application link. There is no indication of direct code execution or data compromise from this vulnerability alone. No known exploits are reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users and administrators should be cautious about clicking on notification links containing redirect parameters and consider implementing additional validation or filtering on the 'next' parameter if possible. Monitoring for suspicious redirect usage may help reduce risk.