URL Redirection to Untrusted Site ('Open Redirect')
This affects all versions of the package Flask-Security. When using the "get_post_logout_redirect" and "get_post_login_redirect" functions, it is possible to bypass URL validation and redirect a user to an arbitrary URL by providing multiple back slashes such as "\\\evil.com/path". This vulnerability is only exploitable if an alternative WSGI server other than Werkzeug is used, or the default behavior of Werkzeug is modified using "autocorrect_location_header=False". **Note:** Flask-Security is not maintained anymore.
CWE-601 - Open Redirect
An open redirect attack employs a URL parameter, HTML refresh tags, or a DOM based location change to exploit the trust of a vulnerable domain to direct the users to a malicious website. The attack could lead to higher severity vulnerabilities such as unauthorized access control, account takeover, XSS, and more.