Open Redirect in Rocket.Chat

Summary

An open redirect vulnerability was identified in Rocket.Chat. The /_saml/sloRedirect/:provider endpoint includes the redirect query string value directly in the Location header for a 302 redirect without any server-side validation. Since this route is accessible without authentication, an attacker can leverage a legitimate Rocket.Chat domain to redirect users to an arbitrary external site. This issue is fixed in v8.4.0.