Open Redirect Affecting @payloadcms/next package, versions >=3.31.0 <3.88.0>=4.0.0-canary.0 <4.0.0-canary.27

Affected versions of this package are vulnerable to Open Redirect through the getSafeRedirect utility in packages/payload/src/utilities/getSafeRedirect.ts and the authentication forms in examples/auth/src/app/(app)/login/LoginForm/index.tsx and examples/auth/src/app/(app)/create-account/CreateAccountForm/index.tsx. An attacker can send a crafted redirect value to a login or account-creation flow and cause a guest user to be sent to an untrusted destination after authenticating. The vulnerable code accepts redirect input from useSearchParams() and passes it to router.push() without restricting it to a known local path, so a malicious link can steer the post-login navigation away from the intended account page. This can be used for phishing and trust abuse by making an authentication link redirect the user to an attacker-controlled site after sign-in.

Workarounds

• Remove user-controlled redirect values from the authentication login and account-creation flows, or restrict redirect to known local paths only, so attackers cannot steer users to an untrusted destination after sign-in.

• GitHub Commit
• Maintainer's Advisory