AIKIDO-2025-10426

TL;DR

Affected versions of this package are vulnerable to Open Redirect due to improper sanitization of the returnURL query parameter in the login functionality. The vulnerability allows attackers to craft malicious links that redirect authenticated users to arbitrary external domains after login, as demonstrated by accessing a URL like https://myapp.com/manage-prototype/password?returnURL=%2F%2Fevil.com. Exploitation occurs when a victim logs in via such a manipulated link, enabling phishing attacks where the attacker can steal credentials or distribute malware by redirecting users to a malicious site under their control.