Blitz Panel Open Redirect Vulnerability in Login Endpoint

A open redirect vulnerability has been identified in Blitz Panel version 1.17.0, specifically within the login endpoint. The issue arises because the application does not properly validate the 'next_url' parameter after authentication. This flaw allows attackers to create malicious login URLs that redirect authenticated users to external domains controlled by the attacker, potentially leading to phishing attacks or theft of session tokens.

Impact

Exploitation of this vulnerability could result in phishing attacks, unauthorized access to session tokens, or redirection of users to malicious websites.

Remediation

Users can upgrade to Blitz Panel version 1.18.1 to address this vulnerability.