AIKIDO-2026-915660

TL;DR

The generated unauthenticated HomeController template builds a redirect target from the attacker-controllable host query parameter and calls redirect_to with allow_other_host: true, so the embedded-app redirect can point at an arbitrary external host. An attacker who lures a user to a crafted URL can redirect them to an attacker-controlled site for phishing or credential harvesting. The template previously performed no validation on the host-derived URL before redirecting off-host. The fix computes the redirect URL, validates it with deduced_phishing_attack?, and falls back to ShopifyApp.configuration.root_url when the target looks suspicious.