Several flows accept redirect or callback URL values from request-controlled input and pass them into Location headers or provider checkout/setup sessions. Affected areas from report.md include dashboard hooks redirects, dashboard project/org slug redirects, public subscription activation callbackUrl handling, checkout activation links, and wallet setup callback URL construction. Impact: authenticated users or checkout customers may be redirected to attacker-controlled origins after trusted Owostack/provider flows. Expected: redirects and provider callback URLs are same-origin, signed, stored, or allowlisted per organization. Fix: reject absolute/protocol-relative URLs for internal redirects, encode path segments, enforce slug format, and validate provider callback origins against configured organization/canonical origins.
Several flows accept redirect or callback URL values from request-controlled input and pass them into Location headers or provider checkout/setup sessions. Affected areas from report.md include dashboard hooks redirects, dashboard project/org slug redirects, public subscription activation callbackUrl handling, checkout activation links, and wallet setup callback URL construction. Impact: authenticated users or checkout customers may be redirected to attacker-controlled origins after trusted Owostack/provider flows. Expected: redirects and provider callback URLs are same-origin, signed, stored, or allowlisted per organization. Fix: reject absolute/protocol-relative URLs for internal redirects, encode path segments, enforce slug format, and validate provider callback origins against configured organization/canonical origins.