The vulnerability in Probo's saferedirect package arises because the redirect URL validator only inspects the second character of relative paths, allowing URLs like '/../\evil.com' to pass validation. Go's http.Redirect normalizes such paths by converting backslashes to slashes, which browsers may interpret as host separators, resulting in redirection to external domains. This bypasses same-origin restrictions and enables open redirect phishing attacks. The fix involves normalizing paths with path.Clean, rejecting backslashes (including percent-encoded ones), and revalidating the normalized path. The vulnerability affects versions before 0.204.0 and is patched in probod v0.194.1 and later. SaaS deployments are already patched.

An attacker can craft malicious redirect URLs that appear to originate from trusted Probo domains but redirect users to external, potentially malicious sites. This can facilitate phishing attacks by exploiting the open redirect vulnerability. The vulnerability does not impact confidentiality or availability but can lead to user deception and potential credential theft or other social engineering outcomes.

Self-hosted Probo deployments should upgrade to probod version 0.194.1 or later to address this vulnerability. SaaS deployments on getprobo.com have already been patched by the vendor. There are no practical workarounds for self-hosted installations prior to the patch. Users should apply the official fix to ensure proper path normalization and validation.