CVE-2026-51564 describes an open redirect vulnerability in the redirect parameter of Milk admin versions up to and including 0.9.8. Remote attackers with high privileges can exploit this flaw by crafting a request that causes users to be redirected to arbitrary external URLs. The vulnerability is categorized as CWE-601 (Open Redirect) and has a CVSS v3.1 base score of 4.9, reflecting medium severity with network attack vector, low attack complexity, required privileges, no user interaction, unchanged scope, no confidentiality or integrity impact, but high impact on availability. There is no known patch or vendor advisory specifying remediation at this time.

The vulnerability allows attackers with high privileges to redirect users to arbitrary external URLs, which can facilitate phishing or other social engineering attacks by misleading users. It does not directly compromise confidentiality or integrity but may impact availability or user trust. There are no known exploits in the wild reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the affected redirect functionality to trusted users only and monitor for suspicious redirect requests. Avoid clicking on unexpected redirects originating from the affected application.