CVE-2026-39600 describes an Open Redirect vulnerability in the Aculect AI Companion software up to version 0.8.1. This vulnerability allows attackers to craft URLs that redirect users to untrusted external sites, potentially facilitating phishing attacks. The CVSS 3.1 base score is 4.7, reflecting network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and low confidentiality impact. There is no indication of integrity or availability impact. No known exploits are reported in the wild, and no vendor advisory or patch information is currently available.

An attacker can exploit this vulnerability to redirect users to malicious websites, which may be used in phishing campaigns to steal user credentials or deliver malware. The confidentiality impact is low, and there is no impact on integrity or availability. The vulnerability requires user interaction to be exploited.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users and administrators should be cautious with URLs received from untrusted sources and consider implementing URL filtering or validation controls to detect and block suspicious redirects.