Pachno Open Redirection Vulnerability in Version 1.0.6

An open redirection vulnerability has been identified in Pachno version 1.0.6. This vulnerability allows attackers to redirect users to arbitrary external websites by manipulating the return_to parameter in login URLs. The lack of proper validation for the return_to values can be exploited to conduct phishing attacks and steal user credentials.

Impact

Exploitation of this vulnerability could lead to open redirection, allowing for phishing attacks and credential theft.

Reproduction

To reproduce this vulnerability, send a login request with a manipulated return_to parameter that points to an external website. The return_to value is not properly validated, allowing for redirection to the specified external site.