Authentication Token Theft via Open Redirect in Callback URL Parameter

Summary

An open redirect vulnerability has been identified in the email signup flow of taplio.com that enables authentication token theft through manipulation of the callback URL parameter.

The vulnerability occurs when an attacker modifies the callbackUrl parameter during the email signup process to point to an attacker-controlled domain. When a victim completes the email verification process by clicking the verification link, they are redirected to the malicious domain along with their authentication tokens. This redirection happens automatically as part of the normal signup flow, making it particularly dangerous since users expect to be redirected after email verification. The vulnerability leverages the trust users place in legitimate verification emails and exploits insufficient validation of the callback URL parameter. The attack requires minimal user interaction beyond the standard email verification process that users routinely perform. The vulnerability affects the authentication mechanism and credential handling within the application's signup workflow.