Open Redirect — Base64-Encoded Parameter Bypasses Client-Side Validation on Login Page
A base64-encoded query parameter on a login/terms acceptance page was decoded and used directly in window.location.href with only protocol validation — no domain check. The writeup covers tracing the vulnerable code in the Angular bundle, crafting the payload, and why the legitimate branding makes this particularly effective for phishing.
Summary
I found a DOM-based open redirect on an identity/SSO provider's terms acceptance page. The application uses a param query parameter containing a base64-encoded URL that gets decoded and assigned to window.location.href after the user accepts terms and clicks "Log In."
The only client-side validation checks the URL protocol (http:// or https://) but not the domain, allowing an attacker to redirect users to any external URL through a legitimate, branded login page.