The issue is a reflected cross-site scripting vulnerability on the loading page displayed while GoCD is starting, via abuse of a `redirect to` query parameter with inadequate validation. Attackers could theoretically abuse the query parameter to steal session tokens or other values from the user's browser. However, exploiting this to perform privileged actions is likely rather difficult because the target user would need to be triggered to open an attacker-crafted link in the period where the server is starting up. Additionally, GoCD server restarts invalidate earlier session tokens, so a stolen session token would be unusable once the server has completed restart.