draw.io versions before 29.7.9 accept a 'gitlab' URL parameter that overrides the GitLab OAuth server URL. An attacker can exploit this by crafting a malicious link that causes the 'Authorize in GitLab' dialog to open a popup pointing to an attacker-controlled domain rather than gitlab.com. This open redirect vulnerability (CWE-601) can facilitate credential phishing and session state token exfiltration. The vulnerability is classified with a CVSS 3.4 (low severity) and has been patched in version 29.7.9.

Successful exploitation can lead to users being redirected to attacker-controlled sites during OAuth sign-in, potentially resulting in credential phishing and session token theft. There is no indication of direct system compromise or denial of service. The impact is limited to confidentiality loss of user credentials and session tokens.

Upgrade draw.io to version 29.7.9 or later, where this vulnerability is patched. Since this is a client-side application vulnerability, applying the official update fully mitigates the issue. No additional vendor advisory was provided, so patch status is confirmed by the version information in the description.