Eternal · Report #143265
Unvalidated redirect on user profile website
Informativestatus
1upvotes
18 May 2017disclosed
How it was found
The user profile redirect request is not properly validated. The presence of parameter t which is being passed through the request is verified but same value can be reused to any unauthenticated or authenticated user to redirect them to any web site.
Sample link is given below.