Open redirect (URL parser differential) in POST /login/ and /register/
Submitted
Open redirect on the login and registration endpoints, reproduced with a backslash in the redirect value: the server validated the URL with one parser, the browser resolved it with another (WHATWG), and the navigation landed on an attacker-controlled host. Full technical detail in [/posts/2026-08-19-open-redirect-via-a-backslash-parser-differential.html](/posts/2026-08-19-open-redirect-via-a-backslash-parser-differential.html).
Outcome
| Field | Value |
|---|---|
| Submission | SOCIALDEAL-XP9XFVVQ |
| Submitted | 2026-09-23 |
| State | Closed — duplicate of SOCIALDEAL-FFIGT8U9 |
| Severity | Low |
| Bounty | None — not paid |
Triager: "...reported before... duplicate."
What I take from it
The finding was correct and still worthless on that day: someone got there first. Duplicates are not a failure of the research, they are a failure of timing — and the only fix is speed on the intake of a program, not more depth on a target everyone already hunts.
Note on the report
The lockout was clean: this went in after the 7-question triage gate, so no false positive reached the program. That part worked.