Nitro versions before 3.0.260429-beta contain a CWE-601 open redirect vulnerability. The flaw arises from the handling of redirect route rules that use wildcards for rewriting URLs. By inserting an additional slash after the rule prefix, an attacker can cause the server to redirect users to an untrusted external site. This behavior can be exploited in phishing or social engineering attacks to redirect users to malicious domains. The vulnerability is fixed in version 3.0.260429-beta.

Successful exploitation allows an attacker to redirect users to arbitrary external websites, potentially facilitating phishing attacks or other social engineering techniques. There is no indication of privilege escalation, data disclosure, or code execution associated with this vulnerability. The impact is limited to user redirection to untrusted sites.

Upgrade Nitro to version 3.0.260429-beta or later, where this open redirect vulnerability is fixed. Since no official patch advisory is provided beyond the fixed version, users should verify upgrade availability from the vendor. No additional mitigations are indicated.