CVE-2026-73671 is an open redirect in Saurus CMS's logout handler, and the severity lies in what the CVSS 6.1 score obscures: this vulnerability lives on an unauthenticated endpoint, meaning anyone can craft a logout link that redirects to an arbitrary external domain. No user account is required to distribute phishing links bearing your legitimate domain. The attack chain—logout followed by redirect to a credential-harvesting page—exploits user trust in the URL bar, not the session itself. Session destruction before redirect is irrelevant to the attacker; they're not stealing sessions, they're weaponizing your domain reputation.
The underlying failure is architectural, not incidental. Saurus CMS provides no structural enforcement of safe redirect patterns—no vetted redirect utility, no allowlist helper, no framework-level rejection of external destinations or javascript: schemes. Developers who want to send users somewhere meaningful after logout face a choice: write a redirect quickly (risky) or hunt for a secure alternative (slow, unclear if it exists). This is a secure-by-design debt. If safe redirects required less code than unsafe ones, this vulnerability wouldn't exist.
Audit your codebase for other unauthenticated redirect points. The logout handler is likely not alone—it's probably the oldest, least-maintained code path in the system. Unauthenticated endpoints are sediment: written before modern security review processes existed, touched only when visibly broken, and forgotten otherwise. Check whether other endpoints in classes/port.inc.php or its siblings have the same pattern. The blast radius of a structural gap is measured in every instance of the pattern, not just the one reported.
The remediation timeline matters. Open redirects become permanent infrastructure in automated phishing kits. Even after a patch releases, unpatched Saurus instances will be targeted for years. Prioritize this fix not because of its technical severity, but because it's a high-effectiveness social engineering vector that your entire user base—authenticated or not—can be exposed to via a single link.