mirror of
https://github.com/agent0ai/agent-zero.git
synced 2026-10-19 15:33:54 +00:00
da24eb04e0
Login redirect responses are followed without validating the target origin. An attacker who can influence the redirect URL could send users to a malicious domain. Add origin validation before following the redirect in both fetchApi() and getCsrfToken() — only follow if the redirect URL origin matches window.location.origin. Severity: Medium |
||
|---|---|---|
| .. | ||
| components | ||
| css | ||
| js | ||
| public | ||
| vendor | ||
| index.css | ||
| index.html | ||
| index.js | ||
| login.css | ||
| login.html | ||