AIKIDO-2026-186060

TL;DR

The return-to-path support used after actions such as login, two-factor authentication, and password confirmation did not verify that the stored path was local. A path beginning with a double slash is treated by browsers as a protocol-relative URL, so return-to-requested-location redirects and the confirm_password flow could send an authenticated user to a remote site. This enables phishing that occurs immediately after a legitimate authentication flow. The fix validates that return-to paths start with a single slash, enforces a size limit, and centralizes the check through a configurable validation method.