The vulnerability CVE-2026-92216 affects the a2ui-project's a2ui component up to version 0.10.7. It is located in the openUrl function of the Binder component (file renderers/web_core/src/v0_9/rendering/generic-binder.ts). This flaw allows an attacker to perform an open redirect by manipulating the URL parameter, potentially redirecting users to malicious external sites. The issue can be exploited remotely without privileges or user interaction beyond clicking a crafted link. The project was notified early but has not provided a response or patch at the time of this report.

The open redirect vulnerability can be used by attackers to redirect users to malicious websites, which may facilitate phishing attacks or other social engineering exploits. However, it does not directly compromise the system or data. The CVSS score of 5.3 reflects a medium severity impact due to the potential for user deception but no direct system compromise.

No official fix or patch is currently available as the vendor has not responded to the issue report. Users should exercise caution when clicking URLs generated by the affected versions of a2ui. Monitor vendor communications for updates and patches. Avoid deploying affected versions in environments where open redirect risks are unacceptable.