Reflected XSS on auth.immutable.com

javascript: scheme in redirect_uri on /im-logged-in → arbitrary JS execution on the authentication domain

Vulnerability

Targetauth.immutable.com/im-logged-in TypeReflected XSS via javascript: URI scheme Sinkwindow.location.href = new URL(redirect_uri) Root causeNo validation of redirect_uri scheme — accepts javascript: Bypass;// comments out appended ?code=&state= params Interaction1-click (victim clicks a crafted link) Execution originhttps://auth.immutable.com