AIKIDO-2025-10261

TL;DR

Affected versions of this package rely on IdentityServer4, which is known to be vulnerable to open redirect attacks. Methods such as GetAuthorizationContextAsync and IsValidReturnUrl may return non-null or true for malicious URLs, enabling redirection to untrusted sites. Less commonly used methods, including ServerUrlExtensions.GetIdentityServerRelativeUrl, ReturnUrlParser.ParseAsync, and OidcReturnUrlParser.ParseAsync, are also affected by similar flaws. The issue is addressed in the fixed version by uninstalling IdentityServer4 packages and disabling related functionality.