This vulnerability (CWE-601) in JetBrains TeamCity affects the SAML plugin and enables open redirect attacks prior to version 2026.1. An open redirect occurs when an application accepts untrusted input that could cause the web application to redirect the request to a URL contained within untrusted input. The CVSS 3.1 base score is 3.1, reflecting low impact with network attack vector, high attack complexity, no privileges required, user interaction required, and limited integrity impact. The vulnerability is published but lacks an official remediation level or patch link from the vendor at this time.

The impact is limited to potential redirection of users to arbitrary external sites, which could facilitate phishing or social engineering attacks. There is no direct confidentiality, availability, or significant integrity impact reported. No known exploitation in the wild has been observed.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should exercise caution with SAML plugin configurations and monitor for updates from JetBrains. No specific temporary mitigations are provided by the vendor.