🎯 New Report #3599248: Bypass of Open Redirect Fix on lovable.dev via /..// Path Traversal in redirect parameter
🔺Severity: Medium
👽 Reporter: marioniangi
⭐️ Reputation: 98
🛠 State: resolved
💼 Team: Lovable VDP
💵 Bounty: null
🕐 Submitted: 2026-03-12
⏰ Disclosed: 2026-03-12 09:57:06
📝 Summary: A bypass was discovered for a previously patched open redirect vulnerability on a web application. The original fix blocked certain payloads, but failed to account for path traversal sequences combined with double slashes. By supplying a specific redirect value, an attacker could still redirect authenticated users to arbitrary external domains. The vulnerability was caused by an incomplete denylist approach rather than proper validation.
📂 Report JSON File: 3599248
@hackeronereports