Open redirect via a backslash parser differential (three stacks, one landing page)

Target redacted. This finding is not submitted to the program nor publicly disclosed yet, so hostnames are replaced with redacted.example and account identifiers are removed. The technical detail is kept intact.

Summary

The login and registration endpoints accepted a redirect value shaped like https://<anything>@redacted.example/ and echoed it verbatim in the JSON response. The client then called navTo(data.redirectUrl). Browsers follow WHATWG URL rules, where a backslash in the authority is treated as /, so the browser lands on the attacker's host while the server's parser saw ours.

Impact

An unauthenticated attacker sends a link on the trusted domain that ends up on their page: phishing, and after a valid login, credential harvesting with the victim's guard down.

Reproduction

1. POST /login/ with redirect=\\evil.example/@redacted.example/ (URL-encoded). 2. The server responds 200 and echoes redirectUrl unchanged. 3. The client navigates to that string; the browser normalises \\ to / and resolves the host as evil.example.

Verified with three independent stacks: curl, Python urllib and a real Chromium navigation.

Negative controls

Five variants were rejected (javascript: → 403, protocol-relative → rejected, absolute off-domain → rejected). The backslash form is the one that slipped through: the server validates with one parser and the browser interprets with another.

Severity

CVSS 3.1 4.7 — AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N. Low, but clean and payable.

Remediation

Allow-list the destination path instead of validating a URL, and compare using the same WHATWG parser the browser uses (new URL(value)), rejecting anything whose origin differs.

Lesson

Parser differentials are the reliable way to bypass redirect validation. Test \\, //, %5C, %2F, Unicode look-alikes and @ before concluding a redirect is safe.