Authenticated reflected XSS on liberapay.com via the back_to parameter when leaving a team.

How it was found

Poc :

https://en.liberapay.com/jio/membership/leave?back_to=http://example.com/

Click the cancel button its redirect to 3rd party site.

Regards, techguy

Impact

This vulnerability could redirect users to the attackers websites for phishing attacks.