🎯 New Report #3581815: Open Redirect on lovable.dev via redirect parameter leads to phishing attacks
🔺Severity: null
👽 Reporter: jdc94
⭐️ Reputation: 123
🛠 State: resolved
💼 Team: Lovable VDP
💵 Bounty: null
🕐 Submitted: 2026-03-02
⏰ Disclosed: 2026-03-05 22:38:35
📝 Summary: An open redirect vulnerability was discovered on the website lovable.dev. After logging in, a request was sent to a URL with a 'redirect' parameter. By supplying a backslash-prefixed value for the 'redirect' parameter, the user could be redirected to an external domain. This vulnerability could have been exploited to craft malicious URLs on the lovable.dev domain that redirect users to arbitrary external sites.
📂 Report JSON File: 3581815
@hackeronereports