A vulnerability in the Red Hat Advanced Cluster Security (ACS) login interface allows for Open Redirect and Content Spoofing via the OAuth callback endpoint. An unauthenticated remote attacker can craft a malicious URL containing unvalidated error and error_uri parameters, which are reflected in the login page. This allows the attacker to display arbitrary error messages and redirect victims to malicious domains under the guise of the trusted application UI.