CVE-2026-33397 is an Open Redirect vulnerability in @angular/ssr caused by an incomplete fix for a previous issue. The flaw allows an attacker to bypass validation by using a single backslash in the X-Forwarded-Prefix header, leading to protocol-relative URL redirects to attacker-controlled domains. This can result in large-scale phishing attacks and SEO poisoning due to cache poisoning and lack of proper response headers. Patches are available in versions 22.0.0-next.2, 21.2.3, and 20.3.21.