BunkerWeb has Open Redirect Vulnerability in Loading Page

Summary:

A open redirect vulnerability exists in the loading endpoint, allowing attackers to redirect authenticated users to arbitrary external URLs via the "next" parameter.

Details:

The loading endpoint accepts and uses an unvalidated "next" parameter for redirects:

PoC:

Visit: /loading?next=https://google.com while authenticated. The page will redirect to google.com.

Impact:

This vulnerability could be used in phishing attacks by redirecting users from a legitimate application URL to malicious sites.