CVE-2026-73671 describes an open redirect vulnerability in Saurus CMS Community Edition. The issue exists in the logout handling code within classes/port.inc.php, where the url parameter supplied via GET or POST is passed directly to the HTTP Location header without domain allowlist checks, scheme validation, or relative path enforcement. This flaw allows attackers to craft malicious logout URLs that redirect users to attacker-controlled external domains or javascript: URIs after session termination, facilitating phishing attacks and OAuth redirect abuse.

The vulnerability enables attackers to redirect authenticated users to arbitrary external sites after logout, which can be used for phishing attacks and credential theft. It may also facilitate abuse of OAuth redirects. However, the vulnerability does not require authentication and has a medium severity score (CVSS 5.1). There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should be cautious about logout URLs and avoid clicking suspicious links. Vendors and administrators should monitor for updates and apply official fixes once released.